Memory Consumption Issue in Django File Upload Handling

CVE-2026-108147

What is CVE-2026-108147?

A memory consumption vulnerability has been identified in Django, specifically within the django.http.multipartparser.MultiPartParser. This issue arises during the handling of multipart file uploads encoded in base64, potentially leading to excessive memory usage as files could be buffered entirely in memory before upload handlers process them. Although Django has released patches for affected versions 6.1, 6.0, and 5.2, unsupported earlier versions (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and might also be vulnerable. Users are encouraged to review the latest security updates and implement necessary patches to safeguard their applications.

References