{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-108147", "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "state": "PUBLISHED", "assignerShortName": "DSF", "dateReserved": "2026-10-09T15:00:14.261Z", "datePublished": "2026-11-03T15:41:38.167Z", "dateUpdated": "2026-11-03T18:26:37.685Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "shortName": "DSF", "dateUpdated": "2026-11-03T15:41:38.167Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130: Excessive Allocation"}]}], "title": "Potential memory exhaustion in MultiPartParser via base64-encoded file upload", "metrics": [{"other": {"content": {"value": "low", "namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels"}, "type": "Django severity rating"}}, {"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.\n`django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ignacy Kujawa for reporting this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.</p><p><code>django.http.multipartparser.MultiPartParser</code> is subject to excessive memory consumption when processing multipart file uploads with base64 <code>Content-Transfer-Encoding</code>, which could be buffered entirely in memory before being passed to upload handlers.</p><p>Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.</p><p>Django would like to thank Ignacy Kujawa for reporting this issue.</p>"}]}], "affected": [{"collectionURL": "https://pypi.org/project/Django/", "defaultStatus": "unaffected", "packageName": "django", "product": "Django", "repo": "https://github.com/django/django/", "vendor": "djangoproject", "versions": [{"status": "affected", "version": "6.1", "lessThan": "6.1.3", "versionType": "python"}, {"status": "unaffected", "version": "6.1.3", "versionType": "python"}, {"status": "unaffected", "version": "6.0", "lessThan": "6.0.4", "versionType": "python"}, {"status": "affected", "version": "6.0.4", "lessThan": "6.0.10", "versionType": "python"}, {"status": "unaffected", "version": "6.0.10", "versionType": "python"}, {"status": "unaffected", "version": "5.2", "lessThan": "5.2.13", "versionType": "python"}, {"status": "affected", "version": "5.2.13", "lessThan": "5.2.19", "versionType": "python"}, {"status": "unaffected", "version": "5.2.19", "versionType": "python"}]}], "references": [{"url": "https://docs.djangoproject.com/en/dev/releases/security/", "name": "Django security archive", "tags": ["vendor-advisory"]}, {"url": "https://groups.google.com/g/django-announce", "name": "Django releases announcements", "tags": ["mailing-list"]}, {"tags": ["patch"], "url": "https://github.com/django/django/commit/5d95d9236fa4ededfb1931c60a65432385ece85f"}, {"tags": ["patch"], "url": "https://github.com/django/django/commit/8b435411f11d69a0dd41a8837654323502e6058e"}, {"tags": ["patch"], "url": "https://github.com/django/django/commit/a29ee4a55acedbe7ba0cb4d2db28c4e4d2848e02"}, {"tags": ["patch"], "url": "https://github.com/django/django/commit/4bd1f59a80adafddbd47527c66d92d6a224244d8"}, {"url": "https://www.djangoproject.com/weblog/2026/nov/03/security-releases/", "name": "Django security releases issued: 6.1.3, 6.0.10, and 5.2.19", "tags": ["vendor-advisory"]}], "credits": [{"lang": "en", "type": "reporter", "value": "Ignacy Kujawa"}, {"lang": "en", "type": "analyst", "value": "Jake Howard"}, {"lang": "en", "type": "analyst", "value": "Natalia Bidart"}, {"lang": "en", "type": "remediation developer", "value": "Natalia Bidart"}, {"lang": "en", "type": "remediation reviewer", "value": "Jake Howard"}, {"lang": "en", "type": "coordinator", "value": "Jacob Walls"}], "timeline": [{"lang": "en", "time": "2026-09-07T12:00:00.000Z", "value": "Initial report received."}, {"lang": "en", "time": "2026-10-15T00:00:00.000Z", "value": "Vulnerability confirmed."}, {"lang": "en", "time": "2026-11-03T09:30:00.000Z", "value": "Security release issued."}], "datePublic": "2026-11-03T09:30:00.000Z", "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T17:51:32.901397Z", "id": "CVE-2026-108147", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T18:26:37.685Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-108147", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-03T17:51:32.901397Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T17:51:35.338Z"}}], "cna": {"title": "Potential memory exhaustion in MultiPartParser via base64-encoded file upload", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Ignacy Kujawa"}, {"lang": "en", "type": "analyst", "value": "Jake Howard"}, {"lang": "en", "type": "analyst", "value": "Natalia Bidart"}, {"lang": "en", "type": "remediation developer", "value": "Natalia Bidart"}, {"lang": "en", "type": "remediation reviewer", "value": "Jake Howard"}, {"lang": "en", "type": "coordinator", "value": "Jacob Walls"}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130: Excessive Allocation"}]}], "metrics": [{"other": {"type": "Django severity rating", "content": {"value": "low", "namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels"}}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}}, {"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}}], "affected": [{"repo": "https://github.com/django/django/", "vendor": "djangoproject", "product": "Django", "versions": [{"status": "affected", "version": "6.1", "lessThan": "6.1.3", "versionType": "python"}, {"status": "unaffected", "version": "6.1.3", "versionType": "python"}, {"status": "unaffected", "version": "6.0", "lessThan": "6.0.4", "versionType": "python"}, {"status": "affected", "version": "6.0.4", "lessThan": "6.0.10", "versionType": "python"}, {"status": "unaffected", "version": "6.0.10", "versionType": "python"}, {"status": "unaffected", "version": "5.2", "lessThan": "5.2.13", "versionType": "python"}, {"status": "affected", "version": "5.2.13", "lessThan": "5.2.19", "versionType": "python"}, {"status": "unaffected", "version": "5.2.19", "versionType": "python"}], "packageName": "django", "collectionURL": "https://pypi.org/project/Django/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-09-07T12:00:00.000Z", "value": "Initial report received."}, {"lang": "en", "time": "2026-10-15T00:00:00.000Z", "value": "Vulnerability confirmed."}, {"lang": "en", "time": "2026-11-03T09:30:00.000Z", "value": "Security release issued."}], "datePublic": "2026-11-03T09:30:00.000Z", "references": [{"url": "https://docs.djangoproject.com/en/dev/releases/security/", "name": "Django security archive", "tags": ["vendor-advisory"]}, {"url": "https://groups.google.com/g/django-announce", "name": "Django releases announcements", "tags": ["mailing-list"]}, {"url": "https://github.com/django/django/commit/5d95d9236fa4ededfb1931c60a65432385ece85f", "tags": ["patch"]}, {"url": "https://github.com/django/django/commit/8b435411f11d69a0dd41a8837654323502e6058e", "tags": ["patch"]}, {"url": "https://github.com/django/django/commit/a29ee4a55acedbe7ba0cb4d2db28c4e4d2848e02", "tags": ["patch"]}, {"url": "https://github.com/django/django/commit/4bd1f59a80adafddbd47527c66d92d6a224244d8", "tags": ["patch"]}, {"url": "https://www.djangoproject.com/weblog/2026/nov/03/security-releases/", "name": "Django security releases issued: 6.1.3, 6.0.10, and 5.2.19", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.\n`django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ignacy Kujawa for reporting this issue.", "supportingMedia": [{"type": "text/html", "value": "<p>An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.</p><p><code>django.http.multipartparser.MultiPartParser</code> is subject to excessive memory consumption when processing multipart file uploads with base64 <code>Content-Transfer-Encoding</code>, which could be buffered entirely in memory before being passed to upload handlers.</p><p>Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.</p><p>Django would like to thank Ignacy Kujawa for reporting this issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "shortName": "DSF", "dateUpdated": "2026-11-03T15:41:38.167Z"}}}, "cveMetadata": {"cveId": "CVE-2026-108147", "state": "PUBLISHED", "dateUpdated": "2026-11-03T18:26:37.685Z", "dateReserved": "2026-10-09T15:00:14.261Z", "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "datePublished": "2026-11-03T15:41:38.167Z", "assignerShortName": "DSF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.org/project/Django/", "defaultStatus": "unaffected", "packageName": "django", "product": "Django", "repo": "https://github.com/django/django/", "vendor": "djangoproject", "versions": [{"lessThan": "6.1.3", "status": "affected", "version": "6.1", "versionType": "python"}, {"status": "unaffected", "version": "6.1.3", "versionType": "python"}, {"lessThan": "6.0.4", "status": "unaffected", "version": "6.0", "versionType": "python"}, {"lessThan": "6.0.10", "status": "affected", "version": "6.0.4", "versionType": "python"}, {"status": "unaffected", "version": "6.0.10", "versionType": "python"}, {"lessThan": "5.2.13", "status": "unaffected", "version": "5.2", "versionType": "python"}, {"lessThan": "5.2.19", "status": "affected", "version": "5.2.13", "versionType": "python"}, {"status": "unaffected", "version": "5.2.19", "versionType": "python"}]}], "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.\n`django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ignacy Kujawa for reporting this issue."}], "id": "CVE-2026-108147", "lastModified": "2026-11-03T19:17:47.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-108147", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T17:51:32.901397Z", "version": "2.0.3"}}]}, "published": "2026-11-03T16:17:18.500", "references": [{"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "url": "https://docs.djangoproject.com/en/dev/releases/security/"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "url": "https://github.com/django/django/commit/4bd1f59a80adafddbd47527c66d92d6a224244d8"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "url": "https://github.com/django/django/commit/5d95d9236fa4ededfb1931c60a65432385ece85f"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "url": "https://github.com/django/django/commit/8b435411f11d69a0dd41a8837654323502e6058e"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "url": "https://github.com/django/django/commit/a29ee4a55acedbe7ba0cb4d2db28c4e4d2848e02"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "url": "https://groups.google.com/g/django-announce"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "url": "https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"}], "sourceIdentifier": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "type": "Secondary"}]}

{"bugzilla": {"description": "django: Potential memory exhaustion in `MultiPartParser` via base64-encoded file upload", "id": "2563998", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563998"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-770", "details": ["An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.\n`django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ignacy Kujawa for reporting this issue.", "A flaw was found in Django. A remote attacker could cause a Denial of Service (DoS) by submitting a specially crafted multipart request with base64-encoded file data. When handling these uploads, the parser buffers the data entirely into system memory regardless of configured upload memory limits, which can exhaust server memory and disrupt application availability."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-108147", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-24/controller-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-24/lightspeed-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-25/controller-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-25/lightspeed-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/eda-controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/gateway-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/hub-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/lightspeed-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/aap-cloud-billing-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/eda-controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/gateway-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/hub-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/lightspeed-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/metrics-service-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/automation-dashboard-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-tech-preview/metrics-service-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "automation-controller", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "python3.11-django", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "python3.12-django", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "python3x-django", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "python-django", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:discovery:2::el8", "fix_state": "Not affected", "package_name": "discovery/discovery-server-rhel9", "product_name": "Red Hat Discovery 2"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "python-django20", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rhosp-rhel8/openstack-horizon", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "python3.12-django", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "satellite/iop-advisor-backend-rhel9", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:rhui:4::el8", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat Update Infrastructure 4 for Cloud Providers"}], "public_date": "2026-11-03T15:30:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-108147\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-108147"], "statement": "This vulnerability is rated as having a Low severity because typical Red Hat environments deploy web services behind reverse proxies and ingress controllers that enforce global request payload size constraints, substantially limiting the memory consumption blast radius. Furthermore, exploitation requires targeting specific application endpoints that accept multipart file submissions with obsolete base64 transfer encoding schemes. While excessive memory allocation may impact individual application worker processes, the flaw cannot be leveraged to achieve code execution or compromise data confidentiality or integrity.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.1,6.1.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.1.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.0,6.0.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.4,6.0.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.0.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.2,5.2.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.2.13,5.2.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.2.19"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Django", "source": "cna", "vendor": "djangoproject"}, "product": "django", "vendor": "django_project"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.1,6.1.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.1.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.0,6.0.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.4,6.0.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.0.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.2,5.2.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.2.13,5.2.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.2.19"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Django", "source": "cna", "vendor": "djangoproject"}, "product": "django", "vendor": "djangoproject"}], "created": "2026-11-03T16:45:13.732950+00:00", "updated": "2026-11-03T16:45:14.066518+00:00", "vendors": ["django_project", "django_project$PRODUCT$django", "djangoproject", "djangoproject$PRODUCT$django"]}