Django REST framework: JSONParser applies an attacker-named codec to the request stream

Summary An unauthenticated attacker can defeat Django's DATAUPLOADMAXMEMORYSIZE limit and force a worker process to allocate arbitrary memory, by naming a compression codec in the Content-Type charset parameter. A 108-byte request body produces a 50,331,648-character value inside the view, an...

Allocation of Resources Without Limits or Throttling

Overview djangorestframework is a powerful and flexible toolkit for building Web APIs. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via JSONParser and FormParser/MultiPartParser in restframework/parsers.py, which passes the client-suppli...

CVE-2026-114136 Django REST framework: JSONParser applies an attacker-named codec to the request stream

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2codec rather than only text encodings. A remote...

CVE-2026-114136

The Django REST framework is vulnerable in versions 3.6.4 through 3.18.2 due to an issue in rest_framework/parsers.py. The JSONParser.parse function incorrectly uses the client-supplied Content-Type charset value with codecs.getreader, which allows for byte-transform codecs like bz2_codec . A rem...

CVE-2026-114136 Django REST framework: JSONParser applies an attacker-named codec to the request stream

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2codec rather than only text encodings. A remote...

RUSTSEC-2026-0366 Stack overflow when parsing deeply nested input in pest_grammars

Impact In affected versions, parsing deeply nested input with pestgrammars::json::JsonParser can exhaust the native stack and abort the hosting process. Applications that accept attacker-controlled JSON without suitable resource limits may therefore be vulnerable to denial of service. The reporte...

Stack overflow when parsing deeply nested input in pest_grammars

Impact In affected versions, parsing deeply nested input with pestgrammars::json::JsonParser can exhaust the native stack and abort the hosting process. Applications that accept attacker-controlled JSON without suitable resource limits may therefore be vulnerable to denial of service. The reporte...

WS-2026-0111

Django REST framework 3.6.4 before 3.18.2: JSONParser decodes the request stream with codecs.getreader using the client-supplied charset, so an attacker can name a non-text codec such as a decompression codec and amplify a small body into large memory use denial of service. GHSA-3547-9m27-7rxg...

ROOT-APP-GOBINARY-CVE-2020-35381 CVE-2020-35381 in github.com/buger/jsonparser - Patched by Root

Root has patched CVE-2020-35381 in the github.com/buger/jsonparser package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-32285 CVE-2026-32285 in github.com/buger/jsonparser - Patched by Root

Root has patched CVE-2026-32285 in the github.com/buger/jsonparser package for Root:Go. Multiple fixed versions available...

Linux Distros Unpatched Vulnerability : CVE-2026-73228

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.pars...

CVE-2026-73228

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

CVE-2026-73228

Django REST Framework before 3.17.2 parses request.data in rest_framework/request.py Request._parse by passing the HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing DATA_UPLOAD_MAX_MEMORY_SIZE. This can allow oversized req...

CVE-2026-73228

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

CVE-2026-73228 Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

CVE-2026-73228: Uncontrolled Resource Consumption

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

PT-2026-70880

Name of the Vulnerable Software and Affected Versions Django REST framework versions prior to 3.17.2 Description Request data parsing in the Request. parse function within rest framework/request.py passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and...

CVE-2026-62295

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested,...

CVE-2026-62295: Improper Input Validation

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested,...

PT-2026-69136

Name of the Vulnerable Software and Affected Versions HAPI FHIR versions prior to 6.9.11 Description The JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser does not enforce a maximum nesting depth for arrays or objects. A syntactically valid but deeply nested FHIR JSON document...