AI BriefingA vulnerability that can freeze a Django server for 1 minute with just a 20MB HTTP packet has been disclosed (CVE-2026-33033)
·2026.04.14 15:58
Key point
A pre-auth CPU exhaustion vulnerability in Django's MultiPartParser has been disclosed.
Details
In Django's MultiPartParser, when the body of a part tagged with Content-Transfer-Encoding: base64 is mostly whitespace, pre-auth CPU exhaustion occurs.
A single request of roughly 2.5MB can increase processing time by over 2,100x compared to normal, tying up server CPU for an extended period and effectively rendering the service unresponsive.
Key details are as follows.
- Vulnerability ID: CVE-2026-33033
- Affected component: Django
MultiPartParser - Condition:
Content-Transfer-Encoding: base64part + mostly whitespace body - Result: Causes excessive CPU consumption at the pre-authentication stage
- Observed effect: Extreme processing delay occurs even with a request of only about 2.5MB
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.