5.3
Medium
CVE-2026-73228 Django REST framework is a toolkit for building Web APIs
Description
Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| django-rest-framework 3.17 | earliest → < 3.17.2 | 3.17.2 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of django-rest-framework
The 5 CVEs of django-rest-framework →
CVE-2026-114138
Django REST framework is a toolkit for building Web APIs
7.5
High
CVE-2026-114137
Django REST framework is a toolkit for building Web APIs
7.4
High
CVE-2026-114136
Django REST framework is a toolkit for building Web APIs
7.5
High
CVE-2026-73229
Django REST framework is a powerful and flexible toolkit for building Web APIs
4.3
Medium