redhat/python3.12-djangorestframework vulnerabilities

Latest redhat/python3.12-djangorestframework CVEs

Newest publication first

1. CVE-2026-114138 Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

   Published 2026-10-21

   High·CVSS 7.5 EPSS 0.60%

   Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer in that file repeatedly invokes _MediaType...

2. CVE-2026-114137 Django REST framework: TokenProxy.delete() reports success and revokes nothing

   Published 2026-10-21

   High·CVSS 7.4 EPSS 0.51%

   Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matc...

3. CVE-2026-114136 Django REST framework: JSONParser applies an attacker-named codec to the request stream

   Published 2026-10-21

   High·CVSS 7.5 EPSS 0.50%

   Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec rather than only text...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.