CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation. As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on `FILE_UPLOAD_MAX_MEMORY_SIZE`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kyle Agronick for reporting this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5766?
CVE-2026-5766 is classified as a potential denial-of-service vulnerability that affects specific versions of Django.
How do I fix CVE-2026-5766?
To fix CVE-2026-5766, you should upgrade to Django version 6.0.5 or 5.2.14 or later.
What is the impact of CVE-2026-5766?
The impact of CVE-2026-5766 allows attackers to bypass the file upload memory size limit, potentially leading to denial-of-service.
Which versions of Django are affected by CVE-2026-5766?
Django versions before 6.0.5 and 5.2 before 5.2.14 are affected by CVE-2026-5766.
Is CVE-2026-5766 a zero-day vulnerability?
No, CVE-2026-5766 is not a zero-day vulnerability as it has been publicly disclosed and patches are available.