CVE-2026-33034

Summary

Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit

Severity

high

EPSS

0.8% (p51)

Also known as

GHSA-933h-hp56-hf7m, BIT-django-2026-33034, PYSEC-2026-49

Published

2026-04-07

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-33034
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django

Related advisories

• CVE-2026-4277 — critical · PyPI/django
• CVE-2025-64459 — critical · PyPI/django
• CVE-2026-3902 — high · PyPI/django
• CVE-2026-25673 — high · PyPI/django
• CVE-2026-1287 — high · PyPI/django
• CVE-2026-1207 — high · PyPI/django
• CVE-2026-1285 — high · PyPI/django
• CVE-2025-14550 — high · PyPI/django

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity