This vulnerability (CWE-130) affects Django web framework versions 6.0 prior to 6.0.5 and 5.2 prior to 5.2.14. When processing ASGI requests, if the Content-Length header is missing or understated, the FILE_UPLOAD_MAX_MEMORY_SIZE limit can be bypassed, allowing large file uploads to be loaded into memory. This can degrade service availability due to excessive memory consumption. The issue was reported by Kyle Agronick. Earlier unsupported Django versions may also be affected but were not evaluated. Django advises enforcing upload size limits at the web server level rather than relying solely on Django's internal limit.

The vulnerability allows attackers to bypass Django's internal file upload memory size limit by manipulating the Content-Length header in ASGI requests. This can cause large files to be loaded into memory, leading to potential service degradation or denial of service due to resource exhaustion. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the official Django vendor advisory for current remediation guidance. Meanwhile, Django recommends configuring file upload size limits at the web server level to mitigate the risk of large uploads consuming excessive memory. Monitor vendor channels for updates and apply official fixes once available.