CVE-2026-114136
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Django REST framework versions 3.6.4 through 3.18.2 use the client-supplied Content-Type charset value with codecs.getreader, accepting byte-transform codecs such as bz2_codec. A remote unauthenticated client can send a compressed JSON body that is expanded after DATA_UPLOAD_MAX_MEMORY_SIZE is enforced, consuming substantial per-worker memory.
Risk Assessment
An attacker can send a very small request that expands to consume large amounts of memory, leading to resource exhaustion and denial of service for other users.
Recommendation
Upgrade Django REST framework to version 3.18.2 or later, which restricts accepted codecs to text encodings.
Other vulnerabilities in Django REST framework
See all- CVE-2026-114138High
Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer in that file repeatedly invokes _MediaType parsing from rest_framework/utils/mediatypes.py for each attacker-controlled token, every renderer, and forced 406 renegotiation. A remote unauthenticated client can send many distinct media types containing large quoted parameter values with numerous semicolons, causing Django's parameter parser and DRF's repeated parsing structure to consume disproportionate CPU. Requests to any reachable endpoint can pin synchronous workers for prolonged periods, and concurrent requests can make the service unavailable until the requests stop. This issue is fixed in version 3.18.2.
- CVE-2026-114137High
In Django REST framework from 3.12.0 until 3.18.2, TokenProxy.delete() uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and reports zero deletions without raising an error. Applications or scripts revoking credentials through a TokenProxy instance may believe revocation succeeded while the token remains live and continues authenticating, and DRF tokens do not expire automatically.
- CVE-2026-73229Medium
Django REST framework prior to 3.17.2 has a vulnerability in AdminRenderer.render() that uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access.
- CVE-2026-73228Medium
Django REST framework prior to 3.17.2 has a vulnerability in request.data parsing in rest_framework/request.py Request._parse(), which passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.
Original NVD description (English source)
Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec rather than only text encodings. A remote unauthenticated client can therefore cause a compressed JSON request body to be expanded after Django has enforced DATA_UPLOAD_MAX_MEMORY_SIZE against only the wire bytes, allowing a very small request to consume substantial per-worker memory. The default parser set is sufficient, and any reachable endpoint that accepts a JSON body is affected. This issue is fixed in version 3.18.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS