Django REST framework: JSONParser applies an attacker-named codec to the request stream

Summary An unauthenticated attacker can defeat Django's DATAUPLOADMAXMEMORYSIZE limit and force a worker process to allocate arbitrary memory, by naming a compression codec in the Content-Type charset parameter. A 108-byte request body produces a 50,331,648-character value inside the view, an...

CVE-2026-114136

The Django REST framework is vulnerable in versions 3.6.4 through 3.18.2 due to an issue in rest_framework/parsers.py. The JSONParser.parse function incorrectly uses the client-supplied Content-Type charset value with codecs.getreader, which allows for byte-transform codecs like bz2_codec . A rem...

CVE-2026-114136 Django REST framework: JSONParser applies an attacker-named codec to the request stream

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2codec rather than only text encodings. A remote...

CVE-2026-114136 Django REST framework: JSONParser applies an attacker-named codec to the request stream

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2codec rather than only text encodings. A remote...

Encode Django REST framework resource management error vulnerability

Encode Django REST framework versions prior to 3.18.2 contain a resource management error vulnerability. This vulnerability arises because JSONParser.parse uses the Content-Type charset value provided by the client to call codecs.getreader, accepting byte conversion and decoding encoders such as...

WS-2026-0111

Django REST framework 3.6.4 before 3.18.2: JSONParser decodes the request stream with codecs.getreader using the client-supplied charset, so an attacker can name a non-text codec such as a decompression codec and amplify a small body into large memory use denial of service. GHSA-3547-9m27-7rxg...