EUVD-2026-117095

WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permissionclasses are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests...

PT-2026-137163

WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send request...

SUSE CVE-2026-114136

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2codec rather than only text encodings. A remote...

SUSE CVE-2026-114137

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete in restframework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and repor...

SUSE CVE-2026-114138

Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.getacceptlist in restframework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while selectrenderer in that file repeatedly invokes MediaType parsing from...

Django REST Framework: TokenProxy.delete() Reports Success And Revokes Nothing

Summary Deleting an authentication token through "TokenProxy" silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling...

Django REST Framework: JSONParser Applies An Attacker-named Codec To The Request Stream

Summary An unauthenticated attacker can defeat Django's "DATAUPLOADMAXMEMORYSIZE" limit and force a worker process to allocate arbitrary memory, by naming a compression codec in the Content-Type charset parameter. A 108-byte request body produces a 50,331,648-character value inside the view, an...

Django REST Framework: Accept Header With Many Large Quoted Parameters Burns ~19s Of CPU Per Request In Content Negotiat

Summary DRF's content negotiation parses each Accept token several times per request and never limits the number of tokens or their total size. Each parse ends up in Django's parseheaderparameters, which takes quadratic time when a quoted parameter value is packed with semicolons. On my machine a...

Linux Distros Unpatched Vulnerability : CVE-2026-114136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied...

Linux Distros Unpatched Vulnerability : CVE-2026-114137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete in restframework/authtoken/models.py uses the proxy's...

Linux Distros Unpatched Vulnerability : CVE-2026-114138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.getacceptlist in restframework/negotiation.py accepts an...

GHSA-XW6W-GCFP-CF8M Django REST framework: TokenProxy.delete() reports success and revokes nothing

Summary Deleting an authentication token through TokenProxy silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling .dele...

Django REST framework: TokenProxy.delete() reports success and revokes nothing

Summary Deleting an authentication token through TokenProxy silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling .dele...

EUVD-2026-107547

Django REST framework: TokenProxy.delete reports success and revokes nothing...

Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

Summary DRF's content negotiation parses each Accept token several times per request and never limits the number of tokens or their total size. Each parse ends up in Django's parseheaderparameters, which takes quadratic time when a quoted parameter value is packed with semicolons. On my machine a...

EUVD-2026-107548

Django REST framework: Accept header with many large quoted parameters burns 19s of CPU per request in content negotiation...

EUVD-2026-107546

Django REST framework: JSONParser applies an attacker-named codec to the request stream...

Django REST framework: JSONParser applies an attacker-named codec to the request stream

Summary An unauthenticated attacker can defeat Django's DATAUPLOADMAXMEMORYSIZE limit and force a worker process to allocate arbitrary memory, by naming a compression codec in the Content-Type charset parameter. A 108-byte request body produces a 50,331,648-character value inside the view, an...

CVE-2026-114137

A flaw was found in Django REST Framework. When an application attempts to revoke authentication credentials using the TokenProxy component, the deletion query targets an incorrect identifier, causing the deletion to silently fail without raising an error. Consequently, revoked credentials remain...

CVE-2026-114138

Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.getacceptlist in restframework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while selectrenderer in that file repeatedly invokes MediaType parsing from...