redhat/python-djangorestframework vulnerabilities

Latest redhat/python-djangorestframework CVEs

Newest publication first

1. CVE-2026-114138 Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

   Published 2026-10-21

   High·CVSS 7.5 EPSS 0.60%

   Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer in that file repeatedly invokes _MediaType...

2. CVE-2026-114137 Django REST framework: TokenProxy.delete() reports success and revokes nothing

   Published 2026-10-21

   High·CVSS 7.4 EPSS 0.51%

   Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matc...

3. CVE-2026-114136 Django REST framework: JSONParser applies an attacker-named codec to the request stream

   Published 2026-10-21

   High·CVSS 7.5 EPSS 0.50%

   Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec rather than only text...

4. CVE-2026-73229 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

   Published 2026-08-11

   Medium·CVSS 4.3

   Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() whil...

5. CVE-2026-73228 Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

   Published 2026-08-11

   Medium·CVSS 5.3 EPSS 0.56%

   Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-f...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.