Description

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-11T19:18:52.603Z",
  "pubdate": "2026-08-11T19:18:52.603Z",
  "executiveSummary": "A memory exhaustion vulnerability exists within the Django REST framework prior to version 3.17.2, specifically affecting request body parsing mechanisms.\nThe flaw allows unauthenticated remote attackers to bypass built-in resource constraints by submitting excessively large request payloads.\nSpecifically, the handling of application/json and application/x-www-form-urlencoded content types via Django REST Framework request.data parsing fails to enforce standard framework limitations.\nAs a result, underlying HttpRequest streams are passed directly to JSONParser and FormParser without respecting Django's configured DATA_UPLOAD_MAX_MEMORY_SIZE protection.\nSuccessful exploitation enables malicious actors to exhaust server memory and CPU resources, potentially leading to denial of service conditions against affected web applications.\nThe vulnerability requires network access to the API endpoint and the ability to dispatch arbitrary oversized HTTP requests with specific content-type headers.",
  "technicalDetails": "The vulnerability resides in rest_framework/request.py within the Request._parse() function of the Django REST framework.\nRoot Cause: The request parsing logic inadequately intercepts or validates incoming data streams against Django's global memory consumption thresholds before handing the payload over to specific parsers.\nVulnerable Components: The Request._parse() method along with JSONParser and FormParser handling application/json and application/x-www-form-urlencoded MIME types respectively.\nAffected Versions: All Django REST framework versions prior to 3.17.2.\nAttack Flow: An attacker crafts an HTTP request containing an oversized body (exceeding DATA_UPLOAD_MAX_MEMORY_SIZE) with a Content-Type header matching JSON or form-urlencoded formats. Upon receipt, the Django REST framework invokes Request._parse(), passing the raw HttpRequest stream directly to the underlying parsers. Because the memory limit checks are bypassed, the server reads the entire massive payload into memory and initiates parsing operations. This forces the host operating system and Python runtime to allocate excessive heap memory and expend high CPU cycles parsing the voluminous input.\nPayload Behavior: The payload does not require execution of arbitrary code; rather, its sheer scale serves as the attack vector to degrade or exhaust hardware resources.\nPrivilege and Authentication Requirements: The vulnerability is generally exploitable remotely over the network without requiring prior authentication, provided the targeted API endpoints accept the affected content types.\nPost-Exploitation Impact: Severe resource exhaustion can lead to application unresponsiveness, worker process crashes, cascading failures across dependent microservices, and localized Denial of Service (DoS)."
}