The vulnerability CVE-2026-33033 affects Django's MultiPartParser in versions 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. It allows remote attackers to cause performance degradation by submitting multipart uploads with 'Content-Transfer-Encoding: base64' headers that include excessive whitespace, leading to inefficient processing. Unsupported earlier Django series may also be affected but were not evaluated. The issue is categorized under CWE-407 (Inefficient Algorithmic Complexity). No known exploits are reported in the wild, and no official patch or remediation level has been published yet.

The impact is a denial of service condition through performance degradation (availability impact) without affecting confidentiality or integrity. Attackers can remotely cause the Django server to consume excessive resources when processing specially crafted multipart uploads, potentially leading to service slowdown or unavailability. There is no indication of data compromise or code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting or filtering multipart upload requests with suspicious 'Content-Transfer-Encoding: base64' headers containing excessive whitespace if feasible. Monitor for unusual performance degradation related to multipart uploads. Avoid relying on generic mitigations unless specifically recommended by the vendor.