{
  "cveId": "CVE-2026-33034",
  "url": "https://patchblox.com/security/cve/CVE-2026-33034",
  "summary": "CVE-2026-33034 is fixed in 3 products on 1 platform, first by DEBIAN-CVE-2026-33034, released April 7, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "python-django: An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30",
  "description": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated \u0060Content-Length\u0060 header could\r bypass the \u0060DATA_UPLOAD_MAX_MEMORY_SIZE\u0060 limit when reading\r \u0060HttpRequest.body\u0060, allowing remote attackers to load an unbounded request body into\r memory. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Superior for reporting this issue.",
  "published": "2026-04-07T07:00:00Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00799,
  "epssPercentile": 0.56772,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "5.2.4-bp160.7.1",
      "fix": "OPENSUSE-SU-2026:20578-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20578-1",
      "released": "2026-04-13T13:39:10Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 14",
      "fixedVersion": "3:4.2.30-1",
      "fix": "DEBIAN-CVE-2026-33034",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-33034",
      "released": "2026-04-07T15:17:39Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "3:4.2.11-1ubuntu1.15",
      "fix": "python3-django 3:4.2.11-1ubuntu1.15",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-django-3-4.2.11-1ubuntu1.15",
      "released": "2026-04-15T18:59:29Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "3:5.2.4-1ubuntu2.4",
      "fix": "python3-django 3:5.2.4-1ubuntu2.4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-python3-django-3-5.2.4-1ubuntu2.4",
      "released": "2026-04-15T18:59:31Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}