A flaw in Django's ASGI request handling allows a remote attacker to craft a request with a missing or understated Content-Length header. This bypasses the DATA_UPLOAD_MAX_MEMORY_SIZE limit, causing the server to load the entire request body into memory. The result is unbounded memory consumption, which can lead to application slowdown or crash, effectively denying service to legitimate users. The weakness falls under Data Size Manipulation (CWE-130) and Memory Consumption (CWE-770).

The vulnerability affects Django releases 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Unchecked, older, unsupported series such as 5.0.x, 4.1.x, and 3.2.x may also be at risk. Application developers using any of these Django versions should verify their current release and plan an upgrade to a patched version.

With a CVSS score of 7.5, the vulnerability is categorized as high severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Nevertheless, attackers can trigger the flaw remotely from the network by sending an ASGI request that intentionally omits or falsely reports the Content-Length header, thereby forcing the server to allocate excessive memory. Patching the Django framework is the only definitive mitigation.