CVE-2026-73228 | Vulnetix

CVE-2026-73228 PUBLISHED CVSS 5.3 MEDIUM

Reported by GitHub_M · Published August 11, 2026

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.

Risk Scores

CVSS 3.1

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Products

Vendor	Product	Versions
encode	django-rest-framework	< 3.17.2
chainguard	authentik-fips-2026.2	0, 0, 0
chainguard	awx	0, 0, 0
chainguard	netbox-fips	0, 0, 0
PyPI	djangorestframework	0
encode	django-rest-framework	< 3.17.2, < 3.17.2, < 3.17.2
chainguard	netbox	0, 0, 0
chainguard	authentik-fips-2026.5	0, 0, 0
chainguard	authentik-2026.5	0, 0, 0

Timeline

Aug 11, 2026 CVE Published
Aug 12, 2026 Coalition ESS Score
Aug 14, 2026 Security Advisory
Aug 24, 2026 EPSS Score
Aug 27, 2026 EPSS Score
Sep 1, 2026 CVE Updated
Sep 1, 2026 EPSS Score
Sep 6, 2026 EPSS Score
Sep 9, 2026 EPSS Score
Sep 12, 2026 EPSS Score
Sep 16, 2026 EPSS Score
Sep 18, 2026 EPSS Score

References

https://github.com/encode/django-rest-framework/security/advisories/GHSA-2m8g-3cmr-wg3w x_refsource_CONFIRM
https://github.com/encode/django-rest-framework/pull/10013 x_refsource_MISC
https://github.com/encode/django-rest-framework/commit/2912dc98042f78e27636551fc22eeaf10f725fdd x_refsource_MISC
https://github.com/encode/django-rest-framework/commit/82ef7b7e4e0a73ba5c489b465fae7e76d948da4e x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2026-73228 advisory
https://github.com/advisories/GHSA-2m8g-3cmr-wg3w advisory
https://github.com/encode/django-rest-framework/releases/tag/3.17.2 url

Open in Interactive Console →