CVE-2026-33033CWE-407

Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload

Medium · published April 7, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
58.8
In the wild
Unconfirmed
What it is

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.

`MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Seokchan Yoon for reporting this issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00882 · 58.8th percentile
Weakness
CWE-407 · Inefficient Algorithmic Complexity
Published
2026-04-07T14:22Z
EPSS history
Timeline
  • 07 APR 14:22Z
    Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload
    cvelistv5