archerysec

支持 您的慷慨捐赠将激励我们继续前进。 Paypal: Archery 工具概述 注意 需求 OpenVAS OWASP Zap Burp Scanner SSLScan Nikto NMAP Vulners 安装 Windows 安装 面向开发者和贡献者的安装说明 关于手动和自动化安装的说明 Docker 安装 通过 docker compose 使用 ArcherySec 设置第三方集成 ZAP 守护模式运行 ZAP 设置 OpenVAS 设置 路线图 首席开发者 贡献者 社交媒体 ArcherySec...

PYSEC-2026-3827 Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies. In the tested...

Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

SummaryWhile investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies.In the tested...

PYSEC-2026-3828 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

SummaryAdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request.If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's G...

CVE-2026-73229

creationtimestamp| type| source ---|---|--- 2026-09-01 20:35:03+00:00| published-proof-of-concept| https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2...

GHSA-2M8G-3CMR-WG3W Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies. In the tested...

EUVD-2026-56887

Django REST framework: Potential bypass of Django DATAUPLOADMAXMEMORYSIZE when parsing oversized JSON and urlencoded request bodies via DRF request.data...

Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies. In the tested...

EUVD-2026-56888

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests...

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...

GHSA-G47C-3XMW-Q6M2 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...

python313-djangorestframework-3.18.0-2.1 on GA media (moderate)

python313-djangorestframework-3.18.0-2.1 on GA media Announcement ID: openSUSE-SU-2026:11625-1 Rating: moderate Cross-References: CVE-2026-73228 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in...

SUSE CVE-2026-73228

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

SUSE CVE-2026-73229

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's restframework/renderers.py AdminRenderer.render uses overridemethod to simulate GET and directly invokes view.get without view.checkpermissions while rendering an invalid write...

CVE-2026-73229

A flaw was found in Django REST framework. The AdminRenderer component, when processing an invalid write request, can improperly invoke a GET request without adequate permission checks. This oversight allows an unauthenticated attacker to access data that they are not authorized to view, leading ...

CVE-2026-73228

A flaw was found in Django REST framework. A remote attacker could exploit a vulnerability in the request.data parsing mechanism, which bypasses Django's DATAUPLOADMAXMEMORYSIZE protection. This allows an attacker to send oversized JSON and URL-encoded request bodies, leading to excessive...

Linux Distros Unpatched Vulnerability : CVE-2026-73228

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.pars...

Linux Distros Unpatched Vulnerability : CVE-2026-73229

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's restframework/renderers.py...

DEBIAN-CVE-2026-73229

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's restframework/renderers.py AdminRenderer.render uses overridemethod to simulate GET and directly invokes view.get without view.checkpermissions while rendering an invalid write...