Django REST Framework Vulnerability in Request Data Parsing

CVE-2026-73228

What is CVE-2026-73228?

The Django REST Framework contains a vulnerability in its request.data parsing mechanism that allows oversized request bodies to bypass critical memory usage restrictions. Specifically, prior to version 3.17.2, the framework's parsing in rest_framework/request.py did not enforce Django's DATA_UPLOAD_MAX_MEMORY_SIZE limit when handling application/json and application/x-www-form-urlencoded content types. This oversight could lead to excessive consumption of server resources, resulting in decreased performance and potential service disruptions.

References