CVE-2026-73228: Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`
Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATAUPLOADMAXMEMORYSIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
django-rest-frameworkto a version that resolves this vulnerability.Fixed in 3.17.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73228?
CVE-2026-73228 has a medium severity rating of 5.3.
What risk does CVE-2026-73228 pose?
CVE-2026-73228 poses a risk level of 27, indicating potential vulnerabilities in request body parsing.
How can I fix CVE-2026-73228?
To fix CVE-2026-73228, update your Django REST framework to version 3.17.2 or later.
What types of request bodies are affected by CVE-2026-73228?
CVE-2026-73228 affects the parsing of oversized JSON and application/x-www-form-urlencoded request bodies.
What is the impact of CVE-2026-73228 on application security?
CVE-2026-73228 may allow attackers to bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit in Django REST framework.