A critical resource exhaustion vulnerability in the Django web framework allows unauthenticated remote attackers to trigger a denial of service by bypassing memory allocation limits.

The vulnerability is an allocation of resources without limits (CWE-770) occurring when processing ASGI requests. An unauthenticated attacker can supply a crafted request with a missing or understated Content-Length header, forcing the server to load an unbounded request body into memory.

Successful exploitation of this flaw leads to a denial of service condition, potentially crashing the web application or consuming all available system memory. Given the CVSS score of 7.5, this is a high-severity issue that threatens service availability and business continuity for any organization relying on the affected Django versions for public-facing services.

Immediate Action: Upgrade Django to version 6.0.4, 5.2.13, or 4.2.30 immediately to apply the necessary resource handling constraints.

Proactive Monitoring: Monitor server memory usage for sudden spikes or abnormal patterns associated with incoming ASGI requests, and review access logs for requests with suspicious or missing headers.

Compensating Controls: Deploy a Web Application Firewall (WAF) or load balancer configured to validate and enforce strict Content-Length header requirements before requests reach the application server.

Public Exploit Available: Unknown

The risk posed by CVE-2026-33034 is significant due to the ease with which an unauthenticated attacker can exhaust server resources. Security teams should prioritize patching across all development, staging, and production environments. If immediate patching is not feasible, ensure that network-level ingress filtering is utilized to drop malformed requests until the software can be updated.