An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8154-1 advisory.

    Seokchan Yoon discovered that Django incorrectly handled copying memory when parsing multipart uploads     with excessive whitespace. A remote attacker could possibly use this issue to cause Django to use     excessive resources, leading to a denial of service. (CVE-2026-33033)

    It was discovered that Django did not enforce an upload memory size limit in the Content-Length header. A     remote attacker could possibly use this issue to cause Django to use excessive resources, leading to a     denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-33034)

    Tarek Nakkouch discovered that Django incorrectly handled underscores in the ASGI headers. A remote     attacker could possibly use this issue to spoof HTTP headers. This issue only affected Ubuntu 22.04 LTS,     Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-3902)

    It was discovered that Django incorrectly handled verification of model data created with POST requests. A     remote attacker could possibly use this issue to forge new model permissions. (CVE-2026-4277,     CVE-2026-4292)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The detected version of the Django Python package is 4.2.x prior to 4.2.30, 5.2.x prior to 5.2.13, or 6.0.x prior to 6.0.4. It is, therefore, affected by multiple vulnerabilities, including:

  - ASGIRequest allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header     variants (with hyphens or with underscores) to a single version with underscores. (CVE-2026-3902)

  - ASGI requests with a missing or understated Content-Length header could bypass the     DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading HttpRequest.body, allowing remote attackers to load an     unbounded request body into memory. (CVE-2026-33034)

  - MultiPartParser allows remote attackers to degrade performance by submitting multipart uploads with     Content-Transfer-Encoding: base64 including excessive whitespace. (CVE-2026-33033)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser`     allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-     Encoding: base64` including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x,     4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon     for reporting this issue. (CVE-2026-33033)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
306095	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Django vulnerabilities (USN-8154-1)	Nessus	Ubuntu Local Security Checks	low
305750	Python Library Django 4.2.x < 4.2.30 / 5.2.x < 5.2.13 / 6.0.x < 6.0.4 Multiple Vulnerabilities	Nessus	Misc.	critical
305221	Linux Distros Unpatched Vulnerability : CVE-2026-33033	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-33033

medium

Tenable Plugins

low

critical

medium