CVE-2026-114136: Django REST framework: JSONParser applies an attacker-named codec to the request stream
Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2codec rather than only text encodings. A remote unauthenticated client can therefore cause a compressed JSON request body to be expanded after Django has enforced DATAUPLOADMAXMEMORYSIZE against only the wire bytes, allowing a very small request to consume substantial per-worker memory. The default parser set is sufficient, and any reachable endpoint that accepts a JSON body is affected. This issue is fixed in version 3.18.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Django REST frameworkto a version that resolves this vulnerability.Fixed in 3.18.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Django REST framework versions from 3.6.4 through 3.18.2 are affected when they have a reachable endpoint that accepts a JSON request body. The default parser configuration is sufficient; no custom parser configuration is required.
What does an attacker need to exploit this issue?
An attacker needs only network access to a reachable JSON-accepting endpoint. Authentication, user interaction, and special privileges are not required.
What is the operational impact?
A client can submit a small compressed request body with an attacker-selected charset codec, causing it to expand in memory after Django's upload-size limit has checked only the compressed wire size. This can consume substantial memory in individual workers and lead to denial of service.
How can this be remediated?
Upgrade Django REST framework to version 3.18.2, which fixes the issue.