ALPINE-CVE-2026-108147: Medium severity alpine/py3-django vulnerability
An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. django.http.multipartparser.MultiPartParser is subject to excessive memory consumption when processing multipart file uploads with base64 Content-Transfer-Encoding, which could be buffered entirely in memory before being passed to upload handlers. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Ignacy Kujawa for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 5.2.19-r0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Django applications that process multipart file uploads using base64 Content-Transfer-Encoding are exposed. The issue can cause excessive memory consumption before the upload is passed to configured upload handlers.
Does exploitation require an authenticated user or user interaction?
No. The supplied severity vector indicates network-reachable exploitation with no privileges required and no user interaction required.
Which Django releases contain fixes?
The issue affects Django releases before 6.1.3 in the 6.1 series, before 6.0.10 in the 6.0.4 series, and before 5.2.19 in the 5.2.13 series. Unsupported series, including 5.1.x, 5.0.x, and 4.2.x, were not evaluated and may also be affected.