Read the docs
TI-2026-78978 Aliases CVE-2026-114136GHSA-3547-9m27-7rxg

Django REST framework JSONParser accepts attacker-chosen codecs

Priority HIGH 72CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

Django REST framework from 3.6.4 before 3.18.2 is affected, in the encode django-rest-framework and PyPI djangorestframework packages. JSONParser passes the client's Content-Type charset to codecs.getreader, which accepts byte-transform codecs such as bz2_codec (CWE-409). An unauthenticated remote client can send a small compressed JSON body that expands after the size limit checks only the wire bytes, consuming substantial memory per worker.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec rather than only text encodings. A remote unauthenticated client can therefore cause a compressed JSON request body to be expanded after Django has enforced DATA_UPLOAD_MAX_MEMORY_SIZE against only the wire bytes, allowing a very small request to consume substantial per-worker memory. The default parser set is sufficient, and any reachable endpoint that accepts a JSON body is affected. This issue is fixed in version 3.18.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00503 43rd percentileScored 2026-11-07
Fix Partial django-rest-framework (encode): 3.18.2djangorestframework (PyPI): 3.18.2Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
encodedjango-rest-framework3.6.4 to before 3.18.23.18.2Patch availableCNA
—djangorestframework (PyPI)3.6.4 to before 3.18.23.18.2Patch availableGHSA-3547-9m27-7rxg
  • django-rest-framework Vendorencode Affected 3.6.4 to before 3.18.2 Fixed in 3.18.2 Patch available CNA
  • djangorestframework (PyPI) Vendor— Affected 3.6.4 to before 3.18.2 Fixed in 3.18.2 Patch available GHSA-3547-9m27-7rxg

Remediation

Upgrade the encode django-rest-framework and PyPI djangorestframework packages to 3.18.2. Red Hat fixes Red Hat Discovery 2 in RHSA-2026:94802, released 2026-11-04. Red Hat gives no available plan for Red Hat Ansible Automation Platform 2 and Red Hat Satellite 6, which are affected without a fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA django-rest-framework (encode) Fixed in 3.18.2
  • Fix · GHSA-3547-9m27-7rxg djangorestframework (PyPI) Fixed in 3.18.2 Advisory →

Red Hat 1 advisory

  • RHSA-2026:94802 Released 2026-11-04 · Red Hat rating Critical
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Discovery 2Fixed RHSA-2026:94802
Not affected: 3 products
  • Red Hat Ansible Automation Platform 2
  • Red Hat Discovery 2
  • Red Hat Update Infrastructure 4 for Cloud Providers

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114136
  2. 2026-10-22 Affected versions changed · Red Hat
  3. 2026-10-22 CVSS score added · Red Hat
  4. 2026-10-22 Alias added: GHSA-3547-9m27-7rxg
  5. 2026-10-22 Fix available: PyPI/[email protected] · GHSA-3547-9m27-7rxg
  6. 2026-10-22 CVSS score added · GHSA-3547-9m27-7rxg
  7. 2026-10-22 Weakness changed · GHSA-3547-9m27-7rxg
  8. 2026-10-22 5 new references · GHSA-3547-9m27-7rxg
  9. 2026-10-23 Affected versions changed · Red Hat
  10. 2026-10-23 Priority changed: MEDIUM → LOW
  11. 2026-10-30 Affected versions changed · Red Hat
  12. 2026-10-30 CISA SSVC decision points changed
  13. 2026-10-30 Priority changed: LOW → HIGH
  14. 2026-11-04 Fix available: RHSA-2026:94802 · Red Hat
  15. 2026-11-04 Fix available: Red Hat Discovery 2 · Red Hat

References

Advisory 1

Other 4

  • TI-2026-35991 Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks KEVCVSS 3.1MEDIUM 6.5
  • TI-2024-32128 Starlette Denial of service (DoS) via multipart/form-data CVSS 4.0HIGH 8.7
  • TI-2026-78981 Django REST framework Accept header parsing causes excessive CPU use CVSS 3.1HIGH 7.5
  • TI-2024-16279 python-multipart vulnerable to content-type header Regular expression Denial of Service CVSS 3.1HIGH 7.5
  • TI-2023-13590 Path traversal in encode Starlette CVSS 3.1HIGH 7.5
  • TI-2026-51365 Uncontrolled resource consumption in encode django-rest-framework CVSS 3.1MEDIUM 5.3
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences