Vulnerability in Django REST Framework Affects Memory Usage via JSON Parser
CVE-2026-114136

7.5HIGH

Key Information:

Vendor

Encode

Status
Django-rest-framework
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114136?

A vulnerability present in Django REST Framework versions 3.6.4 through 3.18.2 allows remote unauthenticated clients to exploit the JSONParser.parse method. This method improperly accepts client-supplied Content-Type charset values, which can lead to the acceptance of byte-transform codecs. As a result, an attacker can craft a compressed JSON request body that expands beyond the expected limits, potentially overwhelming system memory per worker process after Django's DATA_UPLOAD_MAX_MEMORY_SIZE restriction is enforced. This vulnerability affects any reachable endpoint configured to accept JSON bodies. The issue is resolved in version 3.18.2.

Affected Version(s)

django-rest-framework >= 3.6.4, < 3.18.2

References

https://github.com/encode/django-rest-framework/security/...
x_refsource_CONFIRM
https://github.com/encode/django-rest-framework/commit/3c...
x_refsource_MISC
https://github.com/encode/django-rest-framework/releases/...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.