{"api_version":"1","generated_at":"2026-11-11T06:37:19+00:00","cve":"CVE-2026-108147","urls":{"html":"https://cve.report/CVE-2026-108147","api":"https://cve.report/api/cve/CVE-2026-108147.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-108147","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-108147"},"summary":{"title":"Potential memory exhaustion in MultiPartParser via base64-encoded file upload","description":"An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.\n`django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ignacy Kujawa for reporting this issue.","state":"PUBLISHED","assigner":"DSF","published_at":"2026-11-03 16:17:18","updated_at":"2026-11-03 19:17:47"},"problem_types":["CWE-770","CWE-770 CWE-770: Allocation of Resources Without Limits or Throttling"],"metrics":[{"version":"4.0","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary","score":"6.9","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"DECLARED","score":"6.9","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","data":{"baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0"}},{"version":"3.1","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","data":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}}],"references":[{"url":"https://github.com/django/django/commit/8b435411f11d69a0dd41a8837654323502e6058e","name":"https://github.com/django/django/commit/8b435411f11d69a0dd41a8837654323502e6058e","refsource":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://groups.google.com/g/django-announce","name":"https://groups.google.com/g/django-announce","refsource":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://docs.djangoproject.com/en/dev/releases/security/","name":"https://docs.djangoproject.com/en/dev/releases/security/","refsource":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/django/django/commit/4bd1f59a80adafddbd47527c66d92d6a224244d8","name":"https://github.com/django/django/commit/4bd1f59a80adafddbd47527c66d92d6a224244d8","refsource":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/django/django/commit/5d95d9236fa4ededfb1931c60a65432385ece85f","name":"https://github.com/django/django/commit/5d95d9236fa4ededfb1931c60a65432385ece85f","refsource":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.djangoproject.com/weblog/2026/nov/03/security-releases/","name":"https://www.djangoproject.com/weblog/2026/nov/03/security-releases/","refsource":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/django/django/commit/a29ee4a55acedbe7ba0cb4d2db28c4e4d2848e02","name":"https://github.com/django/django/commit/a29ee4a55acedbe7ba0cb4d2db28c4e4d2848e02","refsource":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-108147","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108147","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"djangoproject","product":"Django","version":"affected 6.1 6.1.3 python","platforms":[]},{"source":"CNA","vendor":"djangoproject","product":"Django","version":"unaffected 6.1.3 python","platforms":[]},{"source":"CNA","vendor":"djangoproject","product":"Django","version":"unaffected 6.0 6.0.4 python","platforms":[]},{"source":"CNA","vendor":"djangoproject","product":"Django","version":"affected 6.0.4 6.0.10 python","platforms":[]},{"source":"CNA","vendor":"djangoproject","product":"Django","version":"unaffected 6.0.10 python","platforms":[]},{"source":"CNA","vendor":"djangoproject","product":"Django","version":"unaffected 5.2 5.2.13 python","platforms":[]},{"source":"CNA","vendor":"djangoproject","product":"Django","version":"affected 5.2.13 5.2.19 python","platforms":[]},{"source":"CNA","vendor":"djangoproject","product":"Django","version":"unaffected 5.2.19 python","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-09-07T12:00:00.000Z","lang":"en","value":"Initial report received."},{"source":"CNA","time":"2026-10-15T00:00:00.000Z","lang":"en","value":"Vulnerability confirmed."},{"source":"CNA","time":"2026-11-03T09:30:00.000Z","lang":"en","value":"Security release issued."}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Ignacy Kujawa","lang":"en"},{"source":"CNA","value":"Jake Howard","lang":"en"},{"source":"CNA","value":"Natalia Bidart","lang":"en"},{"source":"CNA","value":"Natalia Bidart","lang":"en"},{"source":"CNA","value":"Jake Howard","lang":"en"},{"source":"CNA","value":"Jacob Walls","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-108147","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-03T17:51:32.901397Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-03T18:26:37.685Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://pypi.org/project/Django/","defaultStatus":"unaffected","packageName":"django","product":"Django","repo":"https://github.com/django/django/","vendor":"djangoproject","versions":[{"lessThan":"6.1.3","status":"affected","version":"6.1","versionType":"python"},{"status":"unaffected","version":"6.1.3","versionType":"python"},{"lessThan":"6.0.4","status":"unaffected","version":"6.0","versionType":"python"},{"lessThan":"6.0.10","status":"affected","version":"6.0.4","versionType":"python"},{"status":"unaffected","version":"6.0.10","versionType":"python"},{"lessThan":"5.2.13","status":"unaffected","version":"5.2","versionType":"python"},{"lessThan":"5.2.19","status":"affected","version":"5.2.13","versionType":"python"},{"status":"unaffected","version":"5.2.19","versionType":"python"}]}],"credits":[{"lang":"en","type":"reporter","value":"Ignacy Kujawa"},{"lang":"en","type":"analyst","value":"Jake Howard"},{"lang":"en","type":"analyst","value":"Natalia Bidart"},{"lang":"en","type":"remediation developer","value":"Natalia Bidart"},{"lang":"en","type":"remediation reviewer","value":"Jake Howard"},{"lang":"en","type":"coordinator","value":"Jacob Walls"}],"datePublic":"2026-11-03T09:30:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.</p><p><code>django.http.multipartparser.MultiPartParser</code> is subject to excessive memory consumption when processing multipart file uploads with base64 <code>Content-Transfer-Encoding</code>, which could be buffered entirely in memory before being passed to upload handlers.</p><p>Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.</p><p>Django would like to thank Ignacy Kujawa for reporting this issue.</p>"}],"value":"An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.\n`django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ignacy Kujawa for reporting this issue."}],"impacts":[{"capecId":"CAPEC-130","descriptions":[{"lang":"en","value":"CAPEC-130: Excessive Allocation"}]}],"metrics":[{"other":{"content":{"namespace":"https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels","value":"low"},"type":"Django severity rating"}},{"cvssV3_1":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}},{"cvssV4_0":{"baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","description":"CWE-770: Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-03T15:41:38.167Z","orgId":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","shortName":"DSF"},"references":[{"name":"Django security archive","tags":["vendor-advisory"],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"name":"Django releases announcements","tags":["mailing-list"],"url":"https://groups.google.com/g/django-announce"},{"tags":["patch"],"url":"https://github.com/django/django/commit/5d95d9236fa4ededfb1931c60a65432385ece85f"},{"tags":["patch"],"url":"https://github.com/django/django/commit/8b435411f11d69a0dd41a8837654323502e6058e"},{"tags":["patch"],"url":"https://github.com/django/django/commit/a29ee4a55acedbe7ba0cb4d2db28c4e4d2848e02"},{"tags":["patch"],"url":"https://github.com/django/django/commit/4bd1f59a80adafddbd47527c66d92d6a224244d8"},{"name":"Django security releases issued: 6.1.3, 6.0.10, and 5.2.19","tags":["vendor-advisory"],"url":"https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"}],"source":{"discovery":"EXTERNAL"},"timeline":[{"lang":"en","time":"2026-09-07T12:00:00.000Z","value":"Initial report received."},{"lang":"en","time":"2026-10-15T00:00:00.000Z","value":"Vulnerability confirmed."},{"lang":"en","time":"2026-11-03T09:30:00.000Z","value":"Security release issued."}],"title":"Potential memory exhaustion in MultiPartParser via base64-encoded file upload","x_generator":{"engine":"cvelib 1.8.0"}}},"cveMetadata":{"assignerOrgId":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","assignerShortName":"DSF","cveId":"CVE-2026-108147","datePublished":"2026-11-03T15:41:38.167Z","dateReserved":"2026-10-09T15:00:14.261Z","dateUpdated":"2026-11-03T18:26:37.685Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-03 16:17:18","lastModifiedDate":"2026-11-03 19:17:47","problem_types":["CWE-770","CWE-770 CWE-770: Allocation of Resources Without Limits or Throttling"],"metrics":{"cvssMetricV40":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-03T17:51:32.901397Z","id":"CVE-2026-108147","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"108147","Ordinal":"1","Title":"Potential memory exhaustion in MultiPartParser via base64-encode","CVE":"CVE-2026-108147","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"108147","Ordinal":"1","NoteData":"An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.\n`django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ignacy Kujawa for reporting this issue.","Type":"Description","Title":"Potential memory exhaustion in MultiPartParser via base64-encode"}]}}}