diff options
Diffstat (limited to 'docs/releases/6.0.4.txt')
| -rw-r--r-- | docs/releases/6.0.4.txt | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/docs/releases/6.0.4.txt b/docs/releases/6.0.4.txt index 4287a3086a..6452768f2a 100644 --- a/docs/releases/6.0.4.txt +++ b/docs/releases/6.0.4.txt @@ -47,6 +47,16 @@ instances to be created via forged ``POST`` data. This issue has severity "low" according to the :ref:`Django security policy <security-disclosure>`. +CVE-2026-33033: Potential denial-of-service vulnerability in ``MultiPartParser`` via base64-encoded file upload +=============================================================================================================== + +When using ``django.http.multipartparser.MultiPartParser``, multipart uploads +with ``Content-Transfer-Encoding: base64`` that include excessive whitespace +may trigger repeated memory copying, potentially degrading performance. + +This issue has severity "moderate" according to the :ref:`Django security +policy <security-disclosure>`. + Bugfixes ======== |