CVE-2026-114136

The Django REST framework is vulnerable in versions 3.6.4 through 3.18.2 due to an issue in rest_framework/parsers.py. The JSONParser.parse function incorrectly uses the client-supplied Content-Type charset value with codecs.getreader, which allows for byte-transform codecs like bz2_codec . A rem...

CVE-2026-114136 Django REST framework: JSONParser applies an attacker-named codec to the request stream

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2codec rather than only text encodings. A remote...