CVE-2026-114136

The Django REST framework is vulnerable in versions 3.6.4 through 3.18.2 due to an issue in rest_framework/parsers.py. The JSONParser.parse function incorrectly uses the client-supplied Content-Type charset value with codecs.getreader, which allows for byte-transform codecs like bz2_codec . A rem...

CVE-2026-114136 Django REST framework: JSONParser applies an attacker-named codec to the request stream

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2codec rather than only text encodings. A remote...

CVE-2026-114136

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2codec rather than only text encodings. A remote...

Encode Django REST framework resource management error vulnerability

Encode Django REST framework versions prior to 3.18.2 contain a resource management error vulnerability. This vulnerability arises because JSONParser.parse uses the Content-Type charset value provided by the client to call codecs.getreader, accepting byte conversion and decoding encoders such as...

Encode Django REST framework resource management error vulnerability

Encode a resource management error vulnerability in Django REST Framework versions prior to 3.18.2. This vulnerability arises from allowing unlimited numbers of Accept tokens and their total size, as well as from repeatedly parsing media types for tokens controlled by attackers. Unauthenticated...

PT-2026-120802

Name of the Vulnerable Software and Affected Versions Django REST framework versions 3.6.4 through 3.18.1 Description The JSONParser.parse function in rest framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader. This allows the use of byte-transform codecs,...

PT-2026-120803

Name of the Vulnerable Software and Affected Versions Django REST framework versions 3.12.0 through 3.18.1 Description The TokenProxy.delete function in rest framework/authtoken/models.py incorrectly uses the proxy's user-id primary key instead of the concrete Token token-string primary key to...

PT-2026-120804

Name of the Vulnerable Software and Affected Versions Django REST framework versions prior to 3.18.2 Description An issue exists where DefaultContentNegotiation.get accept list in rest framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens. The select renderer...

Encode Django REST framework improper exception handling vulnerability

A security vulnerability exists in Django REST Framework versions 3.12.0 through 3.18.2. This vulnerability arises because TokenProxy.delete uses the user ID primary key of the proxy rather than the token string primary key of a specific token. As a result, deletion queries fail to match any rows...

archerysec

Soporte. Sus generosas donaciones nos mantendrán motivados. Paypal: Archery Resumen de la herramienta Nota Requisitos OpenVAS OWASP Zap Burp Scanner SSLScan Nikto NMAP Vulners Instalación Instalación en Windows Nota sobre la instalación para desarrolladores y colaboradores Nota sobre la instalaci...

WS-2026-0111

Django REST framework 3.6.4 before 3.18.2: JSONParser decodes the request stream with codecs.getreader using the client-supplied charset, so an attacker can name a non-text codec such as a decompression codec and amplify a small body into large memory use denial of service. GHSA-3547-9m27-7rxg...

WS-2026-0108

Django REST framework 0.2.0 before 3.18.2: content negotiation splits and parses every media type in the Accept header without limits, so a header with many large quoted parameters costs seconds of CPU per request denial of service. The 0.x and 2.x lines are not fixed. GHSA-33wh-fxxf-88vv...

WS-2026-0107

Django REST framework 3.12.0 before 3.18.2: TokenProxy.pk returns the user id instead of the token key, so deleting a token through the admin or TokenProxy.delete reports success but revokes nothing and the token stays valid. GHSA-xw6w-gcfp-cf8m...

directory-constants (>=21.0.1, <=21.0.2), djongo (1.3.7) +2 more potentially affected by CVE-2026-15307 via django (3.1.12)

django PYPI version 3.1.12 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - directory-constants =21.0.1, =1.1.0rc0, =1.2.0 - rest-framework-djongo 0.1.7 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

SummaryWhile investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies.In the tested...

PYSEC-2026-3827 Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies. In the tested...

PYSEC-2026-3828 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

SummaryAdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request.If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's G...

CVE-2026-73229

creationtimestamp| type| source ---|---|--- 2026-09-01 20:35:03+00:00| published-proof-of-concept| https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2...

Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies. In the tested...