CVE-2026-73228: Django REST Framework DATA_UPLOAD_MAX_MEMORY_SIZE bypass in request.data

CVE-2026-73228 · Severity: medium · CVSS 5.3 · Published 2026-08-11

Django REST Framework's request.data parser bypasses Django's configured upload size limit (DATA_UPLOAD_MAX_MEMORY_SIZE) for JSON and URL-encoded request bodies, allowing attackers to send oversized requests that consume excessive server memory and CPU. While Django itself blocks these requests, DRF's parsing path circumvents the protection, potentially enabling denial-of-service attacks on applications relying on this configuration for resource limits.

Technologies: Django Software Foundation Django REST framework, djangorestframework (PyPI). Vendors: Django Software Foundation, PyPI.

Quick answers

Is CVE-2026-73228 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73228 being exploited in the wild.
How severe is CVE-2026-73228?
Medium severity, with a CVSS score of 5.3, published 11 August 2026.
Which products and versions are affected?
Django Software Foundation Django REST framework < 3.17.2; djangorestframework (PyPI) < 3.17.2, ECOSYSTEM:introduced=0,fixed=3.17.2.
Is there a fix for CVE-2026-73228?
Yes. djangorestframework (PyPI): upgrade to 3.17.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73228 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-73228?
Check whether you run Django Software Foundation Django REST framework or djangorestframework (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • djangorestframework (PyPI): upgrade to 3.17.2 or later
    pip install "djangorestframework>=3.17.2"

Technical details

The vulnerability is a security control bypass in Django REST Framework's request parsing logic. DRF's request.data parser passes the raw Django HttpRequest object directly to JSONParser and FormParser without enforcing Django's DATA_UPLOAD_MAX_MEMORY_SIZE limit. While Django's request.body and request.POST properties enforce this limit by raising RequestDataTooBig, DRF's lower-level streaming approach via HttpRequest.read() bypasses this protection. Attackers without authentication can send large JSON or URL-encoded payloads that successfully parse despite the configured limit, consuming significant memory and CPU. Multipart uploads remain protected because DRF delegates to Django's multipart parser. A fix would require DRF to validate request size before passing the stream to parsers, preserving the intended resource control mechanism for common DRF endpoints.

Affected products

  • Django REST Framework djangorestframework < 3.17.2

Identifiers

  • CVE-2026-73228
  • GHSA-2m8g-3cmr-wg3w
  • PYSEC-2026-3827

Timeline

  • 2026-08-05: disclosed: Published to GitHub Advisory Database
  • 2026-08-05: patched: Version 3.17.2 released with fix
  • 2026-09-01: other: CVE-2026-73228 assigned and published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.