python313-djangorestframework-3.18.2-1.1 on GA media (moderate)

python313-djangorestframework-3.18.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:12277-1 Rating: moderate Cross-References: CVE-2026-114136 CVE-2026-114137 CVE-2026-114138 Affected Products: openSUSE Tumbleweed An update that solves 3 vulnerabilities can now be installed. Description: These...

FreeBSD : py-djangorestframework -- Multiple vulnerabilities (b0395fb0-d45c-11f1-985e-901b0edee044)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b0395fb0-d45c-11f1-985e-901b0edee044 advisory. Bruno Alla reports: An unauthenticated attacker can defeat Django's DATAUPLOADMAXMEMORYSIZE...

ROOT-APP-PYPI-CVE-2026-114136 CVE-2026-114136 in djangorestframework - Patched by Root

Root has patched CVE-2026-114136 in the djangorestframework package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-114137 CVE-2026-114137 in djangorestframework - Patched by Root

Root has patched CVE-2026-114137 in the djangorestframework package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-114138 CVE-2026-114138 in djangorestframework - Patched by Root

Root has patched CVE-2026-114138 in the djangorestframework package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-21520 CVE-2024-21520 in djangorestframework - Patched by Root

Root has patched CVE-2024-21520 in the djangorestframework package for Root:PyPI. Multiple fixed versions available...

PT-2026-127772

These are all security issues fixed in the python313-djangorestframework-3.18.2-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:12277-1 python313-djangorestframework-3.18.2-1.1 on GA media

These are all security issues fixed in the python313-djangorestframework-3.18.2-1.1 package on the GA media of openSUSE Tumbleweed...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 2u-enterprise-data (>=10.22.1, <=10.22.3) +1190 more potentially affected by CVE-2026-114137 via djangorestframework (>=3.12.0, <=3.18.1)

djangorestframework PYPI version =3.12.0, =0.0.0, =10.22.1, =0.12.0, =0.1.0, =0.5.1, =0.1.0b7, =0.9.0, =1.1.12, =0.1.0, =0.1.0, =0.2.1, =1.0.0, =3.1.0 and more Source cves: CVE-2026-114137 Source advisory: OSV:GHSA-XW6W-GCFP-CF8M...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 2u-enterprise-data (>=10.22.1, <=10.22.3) +1190 more potentially affected by CVE-2026-114137 via djangorestframework (>=3.12.0, <=3.18.1)

djangorestframework PYPI version =3.12.0, =0.0.0, =10.22.1, =0.12.0, =0.1.0, =0.5.1, =0.1.0b7, =0.9.0, =1.1.12, =0.1.0, =0.1.0, =0.2.1, =1.0.0, =3.1.0 and more Source cves: CVE-2026-114137 Source advisory: GHSA-XW6W-GCFP-CF8M...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 2u-enterprise-data (>=10.22.1, <=10.22.3) +1190 more potentially affected by CVE-2026-114137 via djangorestframework (>=3.12.0, <=3.18.1)

djangorestframework PYPI version =3.12.0, =0.0.0, =10.22.1, =0.12.0, =0.1.0, =0.5.1, =0.1.0b7, =0.9.0, =1.1.12, =0.1.0, =0.1.0, =0.2.1, =1.0.0, =3.1.0 and more Source cves: CVE-2026-114137 Source advisory: SNYK:PYTHON-DJANGORESTFRAMEWORK-21431457...

Insufficient Session Expiration

Overview djangorestframework is a powerful and flexible toolkit for building Web APIs. Affected versions of this package are vulnerable to Insufficient Session Expiration via TokenProxy.delete and the proxy queryset's delete method in restframework/authtoken/models.py. Because TokenProxy maps pk ...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 2u-enterprise-data (>=10.22.1, <=10.22.3) +1391 more potentially affected by CVE-2026-114138 via djangorestframework (>=2.3.9, <=3.18.1)

djangorestframework PYPI version =2.3.9, =0.0.0, =10.22.1, =0.12.0, =0.1.0, =0.5.1, =0.1.0b7, =0.9.0, =1.1.12, =0.1.0, =0.1.0, =0.2.1, =0.2.5 - ai-aside 3.9.0 and more Source cves: CVE-2026-114138 Source advisory: SNYK:PYTHON-DJANGORESTFRAMEWORK-21431458...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 2u-enterprise-data (>=10.22.1, <=10.22.3) +1391 more potentially affected by CVE-2026-114138 via djangorestframework (>=2.3.9, <=3.18.1)

djangorestframework PYPI version =2.3.9, =0.0.0, =10.22.1, =0.12.0, =0.1.0, =0.5.1, =0.1.0b7, =0.9.0, =1.1.12, =0.1.0, =0.1.0, =0.2.1, =0.2.5 - ai-aside 3.9.0 and more Source cves: CVE-2026-114138 Source advisory: GHSA-33WH-FXXF-88VV...

Inefficient Algorithmic Complexity

Overview djangorestframework is a powerful and flexible toolkit for building Web APIs. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via unbounded parsing of the Accept and Content-Type headers in content negotiation. An attacker can send a request with an...

Allocation of Resources Without Limits or Throttling

Overview djangorestframework is a powerful and flexible toolkit for building Web APIs. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via JSONParser and FormParser/MultiPartParser in restframework/parsers.py, which passes the client-suppli...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 2u-enterprise-data (>=10.22.1, <=10.22.3) +1348 more potentially affected by CVE-2026-114136 via djangorestframework (>=3.6.4, <=3.18.1)

djangorestframework PYPI version =3.6.4, =0.0.0, =10.22.1, =0.12.0, =0.1.0, =0.5.1, =0.1.0b7, =0.9.0, =1.1.12, =0.1.0, =0.1.0, =0.2.1, =0.2.5 - ai-aside 3.9.0 and more Source cves: CVE-2026-114136 Source advisory: SNYK:PYTHON-DJANGORESTFRAMEWORK-21431456...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 2u-enterprise-data (>=10.22.1, <=10.22.3) +1348 more potentially affected by CVE-2026-114136 via djangorestframework (>=3.6.4, <=3.18.1)

djangorestframework PYPI version =3.6.4, =0.0.0, =10.22.1, =0.12.0, =0.1.0, =0.5.1, =0.1.0b7, =0.9.0, =1.1.12, =0.1.0, =0.1.0, =0.2.1, =0.2.5 - ai-aside 3.9.0 and more Source cves: CVE-2026-114136 Source advisory: GHSA-3547-9M27-7RXG...

CVE-2026-114138

A flaw was found in djangorestframework. An unauthenticated remote attacker can cause a Denial of Service DoS by sending HTTP requests with a specially crafted Accept header containing an excessive number of media types with complex parameters. Because the framework performs unbounded and...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 2u-enterprise-data (>=10.22.1, <=10.22.3) +1385 more potentially affected by CVE-2026-114138 via djangorestframework (>=3.1.1, <=3.18.1)

djangorestframework PYPI version =3.1.1, =0.0.0, =10.22.1, =0.12.0, =0.1.0, =0.5.1, =0.1.0b7, =0.9.0, =1.1.12, =0.1.0, =0.1.0, =0.2.1, =0.2.5 - ai-aside 3.9.0 and more Source cves: CVE-2026-114138 Source advisory: MEND:CVE-2026-114138...