CVE-2026-33033 — Inefficient Algorithmic Complexity in Django
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 67.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 7
Latest updateApr 9
Description
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.
`MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6
Affected Packages3 packages
Patches
🔴Vulnerability Details
6📋Vendor Advisories
4Red Hat
▶
Debian▶
CVE-2026-33033: python-django - An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4...↗2026
🕵️Threat Intelligence
1💬Community
1Bugzilla▶
CVE-2026-33033 Django: Django: Performance degradation via excessive whitespace in multipart uploads↗2026-04-07