debian/djangorestframework vulnerabilities

Latest debian/djangorestframework CVEs

Newest publication first

1. CVE-2026-114138 Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

   Published 2026-10-21

   High·CVSS 7.5 EPSS 0.60%

   Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer in that file repeatedly invokes _MediaType...

2. CVE-2026-114137 Django REST framework: TokenProxy.delete() reports success and revokes nothing

   Published 2026-10-21

   High·CVSS 7.4 EPSS 0.51%

   Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matc...

3. CVE-2026-114136 Django REST framework: JSONParser applies an attacker-named codec to the request stream

   Published 2026-10-21

   High·CVSS 7.5 EPSS 0.50%

   Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec rather than only text...

4. CVE-2026-73229 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

   Published 2026-08-11

   Medium·CVSS 4.3 EPSS 0.37%

   Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() whil...

5. CVE-2026-73228 Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

   Published 2026-08-11

   Medium·CVSS 5.3 EPSS 0.56%

   Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-f...

6. CVE-2024-21520 Cross-site Scripting in djangorestframework

   Published 2024-06-26

   Medium·CVSS 5.3 EPSS 1.1%

   Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.

7. CVE-2018-25045 Django REST framework XSS Vulnerability

   Published 2022-07-23

   Medium·CVSS 6.1 EPSS 0.78%

   Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

8. DSA-5186-1 djangorestframework - security update

   Published 2022-07-22

   Unknown

9. CVE-2020-25626 Cross-site Scripting (XSS) in Django REST Framework

   Published 2020-09-30

   Medium·CVSS 6.1 EPSS 1.3%

   A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malic...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.