CVE-2026-5766 — An issue was discovered in 6.0 before 6.0.5 and 5.2 before

title: Django CVE-2026-5766 - Missing Content-Length Header for Large Uploads
id: scw-2026-05-05-ai-1
status: experimental
level: high
description: |
  Detects potential exploitation of CVE-2026-5766 by identifying POST requests to upload-related URIs where the Content-Length header might be missing or understated. This bypasses Django's FILE_UPLOAD_MAX_MEMORY_SIZE limit, allowing large files to be loaded into memory, leading to service degradation. This rule is a proxy for detecting the exploit attempt based on common web server log indicators.
author: SCW Feed Engine (AI-generated)
date: 2026-05-05
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-5766/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-method: 
          - 'POST'
      cs-uri-query|contains:
          - 'null'
      cs-uri|contains:
          - '/upload/'
      # This rule assumes the web server logs contain information about the Content-Length header, 
      # and that 'null' or similar might indicate a missing or understated header in the logs.
      # The exact log format and values will depend on the specific web server and its configuration.
      # This is a conceptual rule to detect the *potential* exploit attempt.
      # A more robust detection would require specific log parsing for Content-Length.
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse