Executive brief
Django REST Framework's request.data parser bypasses Django's configured upload size limit (DATA_UPLOAD_MAX_MEMORY_SIZE) for JSON and URL-encoded request bodies, allowing attackers to send oversized requests that consume excessive server memory and CPU. While Django itself blocks these requests, DRF's parsing path circumvents the protection, potentially enabling denial-of-service attacks on applications relying on this configuration for resource limits.
Technical details
The vulnerability is a security control bypass in Django REST Framework's request parsing logic. DRF's request.data parser passes the raw Django HttpRequest object directly to JSONParser and FormParser without enforcing Django's DATA_UPLOAD_MAX_MEMORY_SIZE limit. While Django's request.body and request.POST properties enforce this limit by raising RequestDataTooBig, DRF's lower-level streaming approach via HttpRequest.read() bypasses this protection. Attackers without authentication can send large JSON or URL-encoded payloads that successfully parse despite the configured limit, consuming significant memory and CPU. Multipart uploads remain protected because DRF delegates to Django's multipart parser. A fix would require DRF to validate request size before passing the stream to parsers, preserving the intended resource control mechanism for common DRF endpoints.
Affected products
- Django REST Framework djangorestframework < 3.17.2
Timeline
- 2026-08-05: disclosed: Published to GitHub Advisory Database
- 2026-08-05: patched: Version 3.17.2 released with fix
- 2026-09-01: other: CVE-2026-73228 assigned and published
References
- https://api.github.com/users/zainnadeem786
- https://github.com/zainnadeem786
- https://api.github.com/users/zainnadeem786/gists%7B/gist_id%7D
- https://api.github.com/users/zainnadeem786/repos
- https://avatars.githubusercontent.com/u/165761530?v=4
- https://api.github.com/users/zainnadeem786/events%7B/privacy%7D