ZeroDay Findings
Sign inSign up

Findings

CVE-2026-5766

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.

Published May 5, 2026 · updated Jun 17, 2026 · djangoproject django

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated header can bypass the limit, potentially loading large files into memory and causing service degradation. As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on . Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kyle Agronick for reporting this issue.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 5, 2026 · NIST NVD

    Detected

    An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated header can bypass the limit, potentially loading large files into memory and causing service degradation. As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on . Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) wer

  2. Jun 17, 2026 · NIST NVD

    Updated

    An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated header can bypass the limit, potentially loading large files into memory and causing service degradation. As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on . Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) wer

Affected

  • cpe djangoproject/djangoversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-5766

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-5766

    An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated header can bypass the limit, potentially loading large files into memory and causing service degradation. As a reminde

    nvd.nist.gov

References