CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated Content-Length header can bypass the FILEUPLOADMAXMEMORYSIZE limit, potentially loading large files into memory and causing service degradation. As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on FILEUPLOADMAXMEMORYSIZE. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kyle Agronick for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 5.2.14-r0 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 6.0.5 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.2.14 - Configuration
Configure a request/file upload size limit at the web server level rather than relying solely on Django's FILE_UPLOAD_MAX_MEMORY_SIZE setting.
Web server request/file upload size limit
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5766?
CVE-2026-5766 is classified as a potential denial-of-service vulnerability that affects specific versions of Django.
How do I fix CVE-2026-5766?
To fix CVE-2026-5766, you should upgrade to Django version 6.0.5 or 5.2.14 or later.
What is the impact of CVE-2026-5766?
The impact of CVE-2026-5766 allows attackers to bypass the file upload memory size limit, potentially leading to denial-of-service.
Which versions of Django are affected by CVE-2026-5766?
Django versions before 6.0.5 and 5.2 before 5.2.14 are affected by CVE-2026-5766.
Is CVE-2026-5766 a zero-day vulnerability?
No, CVE-2026-5766 is not a zero-day vulnerability as it has been publicly disclosed and patches are available.