CVE-2026-73228

Received Received - Intake

Django REST Framework Request Parsing Memory Exhaustion

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73228

EUVD

EUVD-2026-56887

Affected Vendors & Products

Vendor	Product	Version / Range
encode	django_rest_framework	3.17.2
encode	django_rest_framework	to 3.17.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in Django REST Framework (DRF) allows oversized request bodies to bypass Django's memory size protection. DRF's request.data parsing passes raw HttpRequest streams to JSON and form parsers without enforcing DATA_UPLOAD_MAX_MEMORY_SIZE, enabling potential denial-of-service attacks through excessive memory and CPU consumption.

Detection Guidance

To detect this vulnerability, monitor for unusually large request payloads being processed by Django REST Framework endpoints. Check application logs for RequestDataTooBig exceptions or memory/CPU spikes during request handling. Use network monitoring tools to identify abnormally large HTTP request bodies targeting DRF endpoints.

Impact Analysis

Attackers could send oversized JSON or form data to DRF endpoints, consuming excessive server resources. This may lead to degraded performance, service unavailability, or crashes due to memory exhaustion. The impact is limited to availability and does not allow data theft or code execution.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR and HIPAA by enabling denial-of-service attacks through excessive memory and CPU consumption. While it does not directly cause data breaches, resource exhaustion could disrupt services handling sensitive data, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule).

Mitigation Strategies

Upgrade Django REST Framework to version 3.17.2 or later. Ensure Django's DATA_UPLOAD_MAX_MEMORY_SIZE setting is properly configured to limit request body sizes. Monitor for oversized requests and implement rate limiting on DRF endpoints to prevent resource exhaustion.

Hi! I’m here to help you understand CVE-2026-73228. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70