Bug 2563998 (CVE-2026-108147)

Summary: CVE-2026-108147 django: Potential memory exhaustion in `MultiPartParser` via base64-encoded file upload
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: anthomas, brasmith, cmyers, cochase, dnakabaa, dranck, dschmidt, eglynn, ehelms, ggainey, jjoyce, jlanda, jmitchel, jpasqual, jpretori, jschluet, juwatts, jwong, kaycoth, kshier, lblicha, lbrazdil, lcouzens, lhh, mburns, mdellweg, mgarciac, mhulan, mminar, nmoumoul, ogajduse, omaciel, osousa, pcreech, rbiba, rbobbitt, rchan, security-response-team, simaishi, smallamp, sskracic, stcannon, tguha, tmalecek, tpfromme, ttakamiy, yguenane, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Django. A remote attacker could cause a Denial of Service (DoS) by submitting a specially crafted multipart request with base64-encoded file data. When handling these uploads, the parser buffers the data entirely into system memory regardless of configured upload memory limits, which can exhaust server memory and disrupt application availability.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-11-03   

Description OSIDB Bzimport 2026-10-30 13:20:52 UTC 
CVE-2026-108147: Potential memory exhaustion in `MultiPartParser` via base64-encoded file upload

When using `django.http.multipartparser.MultiPartParser`, multipart uploads

with `Content-Transfer-Encoding: base64` could be buffered entirely in memory,
regardless of `FILE_UPLOAD_MAX_MEMORY_SIZE`, before being passed to upload
handlers, potentially consuming excessive memory.

This issue has severity "low" according to the [Django Security Policy](https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels).

Thanks to Ignacy Kujawa for the report.