CVE-2026-33033

CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload

Vendor Djangoproject
Product Django
Weakness CWE-407
Published April 7, 2026
Last update April 7, 2026

CVSS base score

What the vulnerability does

01Description

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

Key dates

02Disclosure timeline

April 7, 2026 CVE published
April 7, 2026 Record updated