A flaw in Django allows code‑running services to bypass the in‑memory file upload limit by omitting or underestablishing the Content‑Length header on ASGI requests. This can cause the framework to load large files into memory, leading to memory exhaustion and service degradation. The weakness is classified as CWE‑130, indicating improper numeric comparison that permits a bypass of a configured limit.

The vulnerability affects Django releases 6.0 before 6.0.5 and 5.2 before 5.2.14. Earlier, unmaintained Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated but could potentially be affected because they share similar upload handling code.

The CVSS score of 6.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in CISA KEV, implying no known large‑scale exploitation to date. The likely attack vector is remote: an attacker can craft a malicious ASGI request that either omits or provides an understated Content‑Length header, causing Django to process a payload larger than the configured FILE_UPLOAD_MAX_MEMORY_SIZE. If the web server does not enforce its own upload limits, the request can flood the application’s memory, leading to throttling or crashes. The risk is therefore contingent on the server configuration, but once the request is able to reach the application, the memory exhaustion can be effectively triggered.