Cloudanix VulnDB

CVE-2026-114136

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Oct 21, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Attackers can send very small requests that make an API server use up huge amounts of memory and stop responding, potentially knocking the service offline until the software is updated.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Web Framework
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

JSONParser.parse accepts arbitrary client-supplied Content-Type charset values and passes them to codecs.getreader, enabling byte-transform codecs such as bz2_codec; decompression therefore occurs after Django's DATA_UPLOAD_MAX_MEMORY_SIZE check has already been applied only to the compressed wire bytes, allowing a small request to expand into large per-worker memory consumption.

Why it matters to the business

Attackers can render API workers unavailable with minimal bandwidth, causing service outages or degraded performance for any application that exposes JSON endpoints; because the issue affects the default parser configuration and requires no authentication, exposure is widespread across Django REST framework deployments until patched.

How an attack unfolds

An unauthenticated remote attacker crafts a JSON POST or PUT whose Content-Type header specifies a compression codec such as bz2_codec, sends a tiny compressed payload that passes the wire-size limit, and forces the server-side parser to decompress it into a much larger object that exhausts worker memory.

How to fix it

Upgrade Django REST framework to version 3.18.2 or later; until the upgrade can be performed, remove JSONParser from the parser_classes on all views or globally restrict acceptable charsets to text encodings only.

How to confirm the fix worked

After upgrade, confirm rest_framework/parsers.py no longer passes arbitrary codec names to codecs.getreader and that requests using non-text charsets are rejected before decompression; test by sending a compressed payload and verifying it is rejected at the wire-size limit.

Typical attack path

  1. Identify any endpoint accepting application/json bodies
  2. Construct a minimal compressed payload using a byte-transform codec
  3. Set the Content-Type header to application/json; charset=<codec>
  4. Issue the request; observe memory growth or worker crash on the target

How to detect it

Review web server and application logs for HTTP requests whose Content-Type header contains charset values other than standard text encodings such as utf-8; correlate spikes in memory usage or worker restarts with such requests; examine access logs for repeated small POST/PUT bodies to JSON endpoints.

What your security team should do

  • Immediately schedule upgrade to 3.18.2 across all Django REST framework instances
  • Temporarily disable JSONParser on public endpoints until patches are applied
  • Add WAF rules to drop requests whose Content-Type charset is not a known text encoding
  • Monitor memory usage and worker restarts on API servers for the next 30 days

The record

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec rather than only text encodings. A remote unauthenticated client can therefore cause a compressed JSON request body to be expanded after Django has enforced DATA_UPLOAD_MAX_MEMORY_SIZE against only the wire bytes, allowing a very small request to consume substantial per-worker memory. The default parser set is sufficient, and any reachable endpoint that accepts a JSON body is affected. This issue is fixed in version 3.18.2.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities