CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload

Published Apr 7, 2026

Updated

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. MultiPartParser allows remote attackers to degrade performance by submitting multipart uploads with Content-Transfer-Encoding: base64 including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

Affected Software

8 affected componentsFixes available

pip/django>=4.2<4.2.30

4.2.30

pip/django>=5.2<5.2.13

5.2.13

pip/django>=6.0<6.0.4

6.0.4

djangoproject Django>=4.2<4.2.30

djangoproject Django>=5.2<5.2.13

djangoproject Django>=6.0<6.0.4

alpine/py3-django<4.2.30-r0

4.2.30-r0

alpine/py3-django<5.2.13-r0

5.2.13-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/Django to a version that resolves this vulnerability.
Fixed in 4.2.30
Upgrade
Upgrade pip/Django to a version that resolves this vulnerability.
Fixed in 5.2.13
Upgrade
Upgrade pip/Django to a version that resolves this vulnerability.
Fixed in 6.0.4
Upgrade
Upgrade alpine/py3-django to a version that resolves this vulnerability.
Fixed in 4.2.30-r0
Upgrade
Upgrade alpine/py3-django to a version that resolves this vulnerability.
Fixed in 5.2.13-r0

Event History

Apr 7, 2026

CVE Published

via MITRE·02:22 PM

Data Sourced

via MITRE·02:22 PM

DescriptionWeakness

Data Sourced

via NVD·03:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Advisory Published

via GitHub·03:30 PM

Data Sourced

via GitHub·03:30 PM

DescriptionSeverityWeaknessAffected Software

CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload

Affected Software

Remediation

Event History

Company

Resources

Contact