Django REST Framework: JSONParser Applies An Attacker-named Codec To The Request Stream

Summary An unauthenticated attacker can defeat Django's "DATAUPLOADMAXMEMORYSIZE" limit and force a worker process to allocate arbitrary memory, by naming a compression codec in the Content-Type charset parameter. A 108-byte request body produces a 50,331,648-character value inside the view, an...