CVE-2026-114136

Name of the Vulnerable Software and Affected Versions Django REST framework versions 3.6.4 through 3.18.1

Description The JSONParser.parse function in rest framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader. This allows the use of byte-transform codecs, such as bz2 codec, instead of limiting them to text encodings. A remote unauthenticated client can send a compressed JSON request body that expands after the system has enforced DATA UPLOAD MAX MEMORY SIZE on the initial wire bytes. This can lead to a small request consuming substantial per-worker memory. Any reachable endpoint that accepts a JSON body is affected.

Recommendations Update to version 3.18.2.