The Django web framework’s MultiPartParser contains a flaw where base64‑encoded file uploads that include excessive whitespace in the Content‑Transfer‑Encoding header force the parser to perform unnecessary decoding, eating CPU cycles and causing the server to slow down or become unresponsive. This reflects a resource‑exhaustion weakness aligned with CWE‑1286 and CWE‑407.

Affected installations include Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Unsupported series such as 5.0.x, 4.1.x, and 3.2.x were not checked but could also be at risk; site owners should verify their current version and plan an upgrade if necessary.

The CVSS score of 6.5 signals moderate severity, while an EPSS below 1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog and no public exploits are known. A remote attacker can trigger the issue via an unauthenticated HTTP POST that contains a multipart upload with base64 encoding and large amounts of whitespace in the header.