This vulnerability arises from improper handling of the Content-Length header in ASGI requests in Django versions 6.0 (before 6.0.5) and 5.2 (before 5.2.14). When the Content-Length header is missing or understated, the FILE_UPLOAD_MAX_MEMORY_SIZE limit can be bypassed, allowing large files to be loaded into memory. This can degrade service performance. The issue is related to CWE-130 (Improper Handling of Length Parameter Inconsistency). Django advises that upload size limits should be enforced at the web server level rather than relying solely on Django's FILE_UPLOAD_MAX_MEMORY_SIZE setting. Earlier unsupported versions may also be affected but were not evaluated. No known exploits are reported in the wild.

The vulnerability can cause denial of service conditions due to excessive memory consumption when large files bypass the configured upload size limit. There is no impact on confidentiality or integrity reported. The primary impact is availability degradation of the Django-hosted service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Meanwhile, it is recommended to enforce upload size limits at the web server or reverse proxy level as per Django's guidance. Monitoring for updates from the Django project is advised to apply official fixes once available.