5.3 CVE-2026-5766

Enriched by CISA Buffer Overflow

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation. As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on `FILE_UPLOAD_MAX_MEMORY_SIZE`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kyle Agronick for reporting this issue.
https://nvd.nist.gov/vuln/detail/CVE-2026-5766

References

6a34fbeb-21d4-45e7-8e0a-62b95bc12c92

https://docs.djangoproject.com/en/dev/releases/security/ Vendor Advisory
https://groups.google.com/g/django-announce Third Party Advisory
https://www.djangoproject.com/weblog/2026/may/05/security-releases/ Vendor Advisory

AFFECTED (from MITRE)

Vendor	Product	Versions
djangoproject	Django	6.0 < 6.0.5 [affected] 6.0.5 [unaffected] 5.2 < 5.2.14 [affected] 5.2.14 [unaffected]
© 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

CPE

cpe	start	end
Configuration 1
cpe:2.3:a:djangoproject:django::::::::	>= 5.2	< 5.2.14
cpe:2.3:a:djangoproject:django::::::::	>= 6.0	< 6.0.5

REMEDIATION

EXPLOITS

Exploit-db.com

id	description	date
No known exploits

POC Github

Url
No known exploits

Other Nist (github, ...)

Url
No known exploits

CAPEC

Common Attack Pattern Enumerations and Classifications

id	description	severity
47	Buffer Overflow via Parameter Expansion In this attack, the target software is given input that the adversary knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow. [Identify target application] The adversary identifies a target application or program to perform the buffer overflow on. Adversaries often look for applications that accept user input and that perform manual memory management. [Find injection vector] The adversary identifies an injection vector to deliver the excessive content to the targeted application's buffer. [Craft overflow content] The adversary crafts the input to be given to the program. If the intent is to simply cause the software to crash, the input needs only to expand to an excessive quantity of random data. If the intent is to leverage the overflow for execution of arbitrary code, the adversary will craft input that expands in a way that not only overflows the targeted buffer but does so in such a way that the overwritten return address is replaced with one of the adversaries' choosing which points to code injected by the adversary. [Overflow the buffer] Using the injection vector, the adversary gives the crafted input to the program, overflowing the buffer.	High

Cybersecurity needs ?

Strengthen software security from the outset with our DevSecOps expertise

Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.

Discover this offer

Soutenez No Hack Me sur Tipeee