bower-cache (0.5.0), django-bird-colony (0.11.1) +6 more potentially affected by CVE-2026-73228 via djangorestframework (2.4.8)

djangorestframework PYPI version 2.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework and may be impacted: - bower-cache 0.5.0 - django-bird-colony 0.11.1 - django-bower-cache 0.5.0 - django-tour =0.6.2, =0.0.2, =1.1.0, =0.0.1,...

acdh-django-vocabs (>=0.1.0, <=0.1.6), acp-calendar (1.6.0) +1161 more potentially affected by CVE-2026-73228 via djangorestframework (>=3.1.1, <=3.17.1)

djangorestframework PYPI version =3.1.1, =0.1.0, =0.9.0, =1.1.12, =0.1.0, =0.19.0b3974, =0.0.1, =0.0.3, =2018.3.1, =2022.6.0.post0, =2.0.0, =1.0.0, =1.0.5 and more Source cves: CVE-2026-73228 Source advisory: OSV:PYSEC-2026-3827...

wger (1.5.0) potentially affected by CVE-2026-73228 via djangorestframework (2.3.13)

djangorestframework PYPI version 2.3.13 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework and may be impacted: - wger 1.5.0 Source cves: CVE-2026-73228 Source advisory: OSV:PYSEC-2026-3827...

CVE-2026-73228 vulnerabilities

Vulnerabilities for packages: authentik, authentik-fips, netbox, awx, netbox-fips...

CVE-2026-73228

creationtimestamp| type| source ---|---|--- 2026-09-01 20:33:07+00:00| seen| https://gist.github.com/alon710/25c48d25038e76519874ccf73ad1c753...

acdh-django-vocabs (>=0.1.0, <=0.1.6), acp-calendar (1.6.0) +1161 more potentially affected by CVE-2026-73228 via djangorestframework (>=3.1.1, <=3.17.1)

djangorestframework PYPI version =3.1.1, =0.1.0, =0.9.0, =1.1.12, =0.1.0, =0.19.0b3974, =0.0.1, =0.0.3, =2018.3.1, =2022.6.0.post0, =2.0.0, =1.0.0, =1.0.5 and more Source cves: CVE-2026-73228 Source advisory: OSV:GHSA-2M8G-3CMR-WG3W...

bower-cache (0.5.0), django-bird-colony (0.11.1) +6 more potentially affected by CVE-2026-73228 via djangorestframework (2.4.8)

djangorestframework PYPI version 2.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework and may be impacted: - bower-cache 0.5.0 - django-bird-colony 0.11.1 - django-bower-cache 0.5.0 - django-tour =0.6.2, =0.0.2, =1.1.0, =0.0.1,...

python313-djangorestframework-3.18.0-2.1 on GA media (moderate)

python313-djangorestframework-3.18.0-2.1 on GA media Announcement ID: openSUSE-SU-2026:11625-1 Rating: moderate Cross-References: CVE-2026-73228 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in...

acdh-django-vocabs (>=0.1.0, <=0.1.6), acp-calendar (1.6.0) +1161 more potentially affected by CVE-2026-73228 via djangorestframework (>=3.1.1, <=3.17.1)

djangorestframework PYPI version =3.1.1, =0.1.0, =0.9.0, =1.1.12, =0.1.0, =0.19.0b3974, =0.0.1, =0.0.3, =2018.3.1, =2022.6.0.post0, =2.0.0, =1.0.0, =1.0.5 and more Source cves: CVE-2026-73228 Source advisory: SNYK:PYTHON-DJANGORESTFRAMEWORK-18853986...

CVE-2026-73228 Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

CVE-2026-73228 Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...