CVE-2026-114136: high-severity vulnerability in encode django-rest-framework
Django REST framework: JSONParser applies an attacker-named codec to the request stream
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.5%
Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec rather than only text encodings. A remote unauthenticated client can therefore cause a compressed JSON request body to be expanded after Django has enforced DATA_UPLOAD_MAX_MEMORY_SIZE against only the wire bytes, allowing a very small request to consume substantial per-worker memory. The default parser set is sufficient, and any reachable endpoint that accepts a JSON body is affected. This issue is fixed in version 3.18.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
encode · django-rest-frameworkRelated CVEs — encode django-rest-framework
In the same product, most dangerous first.
CVE-2026-114138HIGHDjango REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiationEPSS 0.6%CVE-2026-73228MEDIUMDjango REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`EPSS 0.6%CVE-2026-114137HIGHDjango REST framework: TokenProxy.delete() reports success and revokes nothingEPSS 0.5%CVE-2026-73229MEDIUMDjango REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requestsEPSS 0.4%