CVE-2026-114136— Django REST framework: JSONParser applies an attacker-named codec to the request stream
Quick assessment
Affected
encode django-rest-framework
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Django REST framework 是一个用于构建 Web API 的工具包。在 3.6.4 至 3.18.2 版本之间， 中的 方法会直接使用客户端提供的 字符集值，通过 进行读取。然而， 不仅接受文本编码，还允许使用字节转换编解码器（例如 ）。因此，远程未认证的攻击者可以发送一个经过压缩的 JSON 请求体，在 Django 仅对原始网络字节执行 限制之后，再将其解压，从而利用极小的请求消耗大量单个工作进程的内存。默认解析器配置即足以触发此漏洞，任何可访问且接受 JSON 请求体的端点均受影响。该问题已
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1499 · Endpoint Denial of ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| encode | django-rest-framework | >= 3.6.4, < 3.18.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114136
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Django REST framework: JSONParser applies an attacker-named codec to the request stream
Source: CVE Program / CVE List V5
Vulnerability Description
Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec rather than only text encodings. A remote unauthenticated client can therefore cause a compressed JSON request body to be expanded after Django has enforced DATA_UPLOAD_MAX_MEMORY_SIZE against only the wire bytes, allowing a very small request to consume substantial per-worker memory. The default parser set is sufficient, and any reachable endpoint that accepts a JSON body is affected. This issue is fixed in version 3.18.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| encode | django-rest-framework | >= 3.6.4, < 3.18.2 | - |
|
II. Public POCs for CVE-2026-114136
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114136
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-114136 (1)
Vendor Advisories for CVE-2026-114136 (1)
Vendor Pages for CVE-2026-114136 (1)
-
🔗 Release 3.18.2 · encode/django-rest-framework · GitHub x_refsource_MISC
Same Patch Batch · encode · 2026-10-21 · 3 CVEs total
| CVE-2026-114138 | 7.5 HIGH | Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU p |
| CVE-2026-114137 | 7.4 HIGH | Django REST framework: TokenProxy.delete() reports success and revokes nothing |
IV. Related Vulnerabilities
Same product: django-rest-framework
-
CVE-2026-114138
Django REST framework: Accept header with many large quoted -
CVE-2026-114137
Django REST framework: TokenProxy.delete() reports success a -
CVE-2026-73229
Django REST framework: AdminRenderer may disclose GET-protec -
CVE-2026-73228
Django REST framework: Potential bypass of Django `DATA_UPLO
Same vendor: encode
-
CVE-2026-114138
Django REST framework: Accept header with many large quoted -
CVE-2026-114137
Django REST framework: TokenProxy.delete() reports success a -
CVE-2026-73229
Django REST framework: AdminRenderer may disclose GET-protec -
CVE-2026-73228
Django REST framework: Potential bypass of Django `DATA_UPLO -
CVE-2025-54121
Starlette has possible denial-of-service vector when parsing
Same weakness: CWE-409
-
CVE-2026-115638
OpenStack Ironic 39.0.1 前版本配置驱动拒绝服务漏洞 -
CVE-2026-115503
Ghidra before 12.2 Denial of Service via Compressed Extensio -
CVE-2026-115396
Ghidra 10.3 before 12.2 Denial of Service via Compressed The -
CVE-2026-113873
SmileCDR HAPI FHIR improper data decompression -
CVE-2026-93471
Unbounded SAML message decompression in esaml allows memory
V. Comments for CVE-2026-114136
No comments yet