CVE-2026-73228
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Django REST framework prior to 3.17.2 has a vulnerability in request.data parsing in rest_framework/request.py Request._parse(), which passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.
Risk Assessment
Bypassing protection against large request bodies could lead to resource exhaustion (DoS) and application slowdown, potentially affecting service availability.
Recommendation
It is recommended to immediately upgrade Django REST framework to version 3.17.2 or later. Also, consider additional request size limits at the server level.
Other vulnerabilities in Django REST framework
See all- CVE-2026-114138High
Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer in that file repeatedly invokes _MediaType parsing from rest_framework/utils/mediatypes.py for each attacker-controlled token, every renderer, and forced 406 renegotiation. A remote unauthenticated client can send many distinct media types containing large quoted parameter values with numerous semicolons, causing Django's parameter parser and DRF's repeated parsing structure to consume disproportionate CPU. Requests to any reachable endpoint can pin synchronous workers for prolonged periods, and concurrent requests can make the service unavailable until the requests stop. This issue is fixed in version 3.18.2.
- CVE-2026-114137High
In Django REST framework from 3.12.0 until 3.18.2, TokenProxy.delete() uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and reports zero deletions without raising an error. Applications or scripts revoking credentials through a TokenProxy instance may believe revocation succeeded while the token remains live and continues authenticating, and DRF tokens do not expire automatically.
- CVE-2026-114136High
Django REST framework versions 3.6.4 through 3.18.2 use the client-supplied Content-Type charset value with codecs.getreader, accepting byte-transform codecs such as bz2_codec. A remote unauthenticated client can send a compressed JSON body that is expanded after DATA_UPLOAD_MAX_MEMORY_SIZE is enforced, consuming substantial per-worker memory.
- CVE-2026-73229Medium
Django REST framework prior to 3.17.2 has a vulnerability in AdminRenderer.render() that uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access.
Original NVD description (English source)
Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS