redhat/tfm-pulpcore-python-djangorestframework vulnerabilities

Latest redhat/tfm-pulpcore-python-djangorestframework CVEs

Newest publication first

1. CVE-2026-73229 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

   Published 2026-08-11

   Medium·CVSS 4.3 EPSS 0.37%

   Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() whil...

2. CVE-2026-73228 Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

   Published 2026-08-11

   Medium·CVSS 5.3 EPSS 0.56%

   Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-f...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.