CVE-2026-33033
unknown
CVSS v3
—
CVSS v2
—
VIR risk
—
Description
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2026-33033
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2026-33033.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| debian | bookworm | affected | |
| debian | bullseye | affected | |
| debian | forky | fixed | 3:4.2.30-1 |
| debian | sid | fixed | 3:4.2.30-1 |
| debian | trixie | affected | |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-33033
- https://docs.djangoproject.com/en/dev/releases/security
- https://github.com/django/django
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2026/apr/07/security-releases
- https://docs.djangoproject.com/en/dev/releases/security/
- https://www.djangoproject.com/weblog/2026/apr/07/security-releases/
- https://www.suse.com/security/cve/CVE-2026-33033.html
- https://security-tracker.debian.org/tracker/CVE-2026-33033
Verify integrity in audit chain (admin only). AS-IS.