An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading `HttpRequest.body`, allowing remote attackers to load an unbounded request body into memory. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Superior for reporting this issue.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b9548393aa advisory.

    - Fixes CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit     bypass
    - Fixes CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
    - Fixes CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in     UpdateCacheMiddleware
    - Fixes CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation
    - Fixes CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin
    - Fixes CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable
    - Fixes CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded     file upload
    - Fixes CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit     bypass
    - Fixes CVE-2026-25674: Potential incorrect permissions on newly created file system objects


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1740-1 advisory.

    This update for python-Django fixes the following issues

    - CVE-2026-3902: headers spoofing by exploiting an ambiguous mapping of two header variants in     `ASGIRequest` requests       (bsc#1261729).
    - CVE-2026-4277: permissions on inline model instances were not validated on submission of forged POST     data in       GenericInlineModelAdmin (bsc#1261731).
    - CVE-2026-4292: admin changelist forms using ModelAdmin.list_editable incorrectly allowed new instances     to be created       via forged POST data (bsc#1261732).
    - CVE-2026-5766: potential denial-of-service vulnerability in ASGI requests via file upload limit bypass     (bsc#1264153).
    - CVE-2026-6907: potential exposure of private data due to incorrect handling of `Vary: *` in     `UpdateCacheMiddleware`       (bsc#1264152).
    - CVE-2026-33033: denial of service via missing or understated Content-Length header in ASGI requests     (bsc#1261722).
    - CVE-2026-33034: ASGI requests with a missing or understated Content-Length header could bypass the       `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading HttpRequest.body (bsc#1261724).
    - CVE-2026-35192: session fixation via public cached pages and `SESSION_SAVE_EVERY_REQUEST` (bsc#1264154).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8154-1 advisory.

    Seokchan Yoon discovered that Django incorrectly handled copying memory when parsing multipart uploads     with excessive whitespace. A remote attacker could possibly use this issue to cause Django to use     excessive resources, leading to a denial of service. (CVE-2026-33033)

    It was discovered that Django did not enforce an upload memory size limit in the Content-Length header. A     remote attacker could possibly use this issue to cause Django to use excessive resources, leading to a     denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-33034)

    Tarek Nakkouch discovered that Django incorrectly handled underscores in the ASGI headers. A remote     attacker could possibly use this issue to spoof HTTP headers. This issue only affected Ubuntu 22.04 LTS,     Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-3902)

    It was discovered that Django incorrectly handled verification of model data created with POST requests. A     remote attacker could possibly use this issue to forge new model permissions. (CVE-2026-4277,     CVE-2026-4292)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The detected version of the Django Python package is 4.2.x prior to 4.2.30, 5.2.x prior to 5.2.13, or 6.0.x prior to 6.0.4. It is, therefore, affected by multiple vulnerabilities, including:

  - ASGIRequest allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header     variants (with hyphens or with underscores) to a single version with underscores. (CVE-2026-3902)

  - ASGI requests with a missing or understated Content-Length header could bypass the     DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading HttpRequest.body, allowing remote attackers to load an     unbounded request body into memory. (CVE-2026-33034)

  - MultiPartParser allows remote attackers to degrade performance by submitting multipart uploads with     Content-Transfer-Encoding: base64 including excessive whitespace. (CVE-2026-33033)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with     a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when     reading `HttpRequest.body`, allowing remote attackers to load an unbounded request body into memory.
    Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be     affected. Django would like to thank Superior for reporting this issue. (CVE-2026-33034)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
314604	Fedora 42 : python-django5 (2026-b9548393aa)	Nessus	Fedora Local Security Checks	medium
313665	SUSE SLES15 Security Update : python-Django (SUSE-SU-2026:1740-1)	Nessus	SuSE Local Security Checks	medium
306095	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Django vulnerabilities (USN-8154-1)	Nessus	Ubuntu Local Security Checks	low
305750	Python Library Django 4.2.x < 4.2.30 / 5.2.x < 5.2.13 / 6.0.x < 6.0.4 Multiple Vulnerabilities	Nessus	Misc.	critical
305222	Linux Distros Unpatched Vulnerability : CVE-2026-33034	Nessus	Misc.	high

Detections

Analytics

CVE-2026-33034

high

Tenable Plugins

medium

medium

low

critical

high