CVE-2026-114138

Name of the Vulnerable Software and Affected Versions Django REST framework versions prior to 3.18.2

Description An issue exists where DefaultContentNegotiation.get accept list in rest framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens. The select renderer function repeatedly invokes MediaType parsing from rest framework/utils/mediatypes.py for each attacker-controlled token, every renderer, and forced 406 renegotiation. A remote unauthenticated client can send numerous distinct media types containing large quoted parameter values with many semicolons, causing the parameter parser and repeated parsing structure to consume excessive CPU. This can pin synchronous workers for extended periods, potentially making the service unavailable when concurrent requests are sent to any reachable endpoint.

Recommendations Update to version 3.18.2.