CVE-2026-5766

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated Content-Length header can bypass the FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into memory and causing service degradation.

As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on FILE_UPLOAD_MAX_MEMORY_SIZE. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kyle Agronick for reporting this issue.

Database specific

{
    "cna_assigner": "DSF",
    "cwe_ids": [
        "CWE-130"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5766.json"
}

References

Affected packages

Git / github.com/django/django

Affected ranges

Type

GIT

Repo

https://github.com/django/django

Events

Introduced

9e7cc2b628fe8fd3895986af9b7fc9525034c1b0

Fixed

024c26b1e77ea5b1b158265167ade47927a64c06

Introduced

36b5f39d9372147f0e758f590e35ee2b2bc317dd

Fixed

8f8ad09659d728423a00e0a3b5f16da5c3a38e24

Database specific

{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "5.2"
        },
        {
            "fixed": "5.2.14"
        },
        {
            "introduced": "6.0"
        },
        {
            "fixed": "6.0.5"
        }
    ],
    "cpe": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*"
}

Affected versions

5.*

5.2

5.2.1

5.2.10

5.2.11

5.2.12

5.2.13

5.2.2

5.2.3

5.2.4

5.2.5

5.2.6

5.2.7

5.2.8

5.2.9

6.*

6.0

6.0.1

6.0.2

6.0.3

6.0.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5766.json"