CVE-2026-5766
MediumSummary
An issue was discovered in versions 6.0 before 6.0.5 and 5.2 before 5.2.14 related to ASGI requests that can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit when the `Content-Length` header is missing or understated. This may lead to large files being loaded into memory, causing service degradation.
Risk Assessment
The organization may experience service performance degradation due to uncontrolled loading of large files into memory, potentially leading to system crashes or application slowdowns.
Recommendation
It is recommended to upgrade to versions 6.0.5 or 5.2.14 to mitigate this issue and to monitor ASGI requests for appropriate headers.
Original NVD description (English source)
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation. As a reminder, Django expects a