CVE-2026-114138

Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.getacceptlist in restframework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while selectrenderer in that file repeatedly invokes MediaType parsing from...

CVE-2026-114138

The Django REST framework toolkit is vulnerable to a denial of service (DoS) attack due to inefficient algorithmic complexity in content negotiation. Specifically, the DefaultContentNegotiation.get_accept_list function in rest_framework/negotiation.py accepts an unbounded number and size of Accep...

EUVD-2026-107548

Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.getacceptlist in restframework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while selectrenderer in that file repeatedly invokes MediaType parsing from...

CVE-2026-114138 Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.getacceptlist in restframework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while selectrenderer in that file repeatedly invokes MediaType parsing from...