Is CVE-2026-114136 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114136 being exploited in the wild.

How severe is CVE-2026-114136?

High severity, with a CVSS score of 7.5, published 21 October 2026.

Which products and versions are affected?

Django Software Foundation Django REST framework 3.6.4 through 3.18.1; djangorestframework (PyPI) >= 3.6.4, < 3.18.2, ECOSYSTEM:introduced=3.6.4,fixed=3.18.2.

Is there a fix for CVE-2026-114136?

Yes. djangorestframework (PyPI): upgrade to 3.18.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114136 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114136?

Check whether you run Django Software Foundation Django REST framework or djangorestframework (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114136: Django REST framework memory amplification via charset codec

Q: Is there a fix for CVE-2026-114136?

Yes. djangorestframework (PyPI): upgrade to 3.18.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114136 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-114136?

Check whether you run Django Software Foundation Django REST framework or djangorestframework (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114136 · Severity: high · CVSS 7.5 · Published 2026-10-21

Django REST framework is a toolkit for building web APIs in Python applications. An unauthenticated attacker can send a specially crafted request with a compression codec specified in the Content-Type header to cause a small request body to expand into massive amounts of memory on the server, potentially causing denial of service or worker process crashes.

Technologies: Django Software Foundation Django REST framework, djangorestframework (PyPI). Vendors: Django Software Foundation, PyPI.

Quick answers

Is CVE-2026-114136 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114136 being exploited in the wild.
How severe is CVE-2026-114136?: High severity, with a CVSS score of 7.5, published 21 October 2026.
Which products and versions are affected?: Django Software Foundation Django REST framework 3.6.4 through 3.18.1; djangorestframework (PyPI) >= 3.6.4, < 3.18.2, ECOSYSTEM:introduced=3.6.4,fixed=3.18.2.
Is there a fix for CVE-2026-114136?: Yes. djangorestframework (PyPI): upgrade to 3.18.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114136 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114136?: Check whether you run Django Software Foundation Django REST framework or djangorestframework (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

djangorestframework (PyPI): upgrade to 3.18.2 or later
```
pip install "djangorestframework>=3.18.2"
```

Technical details

JSONParser.parse in rest_framework/parsers.py incorrectly accepts byte-transform codecs (such as bz2_codec) via the client-supplied Content-Type charset value passed to codecs.getreader(), rather than restricting to text encodings. This allows compressed request bodies to expand after Django's DATA_UPLOAD_MAX_MEMORY_SIZE enforcement, which only counts wire bytes. An unauthenticated network attacker can send a crafted compressed payload to any endpoint accepting JSON to consume substantial per-worker memory. The fix restricts charset resolution to text encodings only.

Affected products

Django Software Foundation Django REST framework 3.6.4 through 3.18.1

Identifiers

CVE-2026-114136
GHSA-3547-9m27-7rxg

Timeline

2026-10-21: disclosed
2026-10-06: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.