CVE-2026-73228
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Django REST framework prior to 3.17.2 has a vulnerability in request.data parsing in rest_framework/request.py Request._parse(), which passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.
Risk Assessment
Bypassing protection against large request bodies could lead to resource exhaustion (DoS) and application slowdown, potentially affecting service availability.
Recommendation
It is recommended to immediately upgrade Django REST framework to version 3.17.2 or later. Also, consider additional request size limits at the server level.
Original NVD description (English source)
Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.