CVE-2026-73228

Name of the Vulnerable Software and Affected Versions Django REST framework versions prior to 3.17.2

Description Request data parsing in the Request. parse() function within rest framework/request.py passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies. This process bypasses the DATA UPLOAD MAX MEMORY SIZE protection provided by Django, which can lead to excessive memory and CPU consumption when processing oversized request bodies.

Recommendations Update Django REST framework to version 3.17.2.