Django DRF request.data bypasses DATA_UPLOAD_MAX_MEMORY_SIZE for large payloads

Vulnerability Overview Title: Potential bypass of Django when parsing oversized JSON and urlencoded request bodies via DRF Description: Summary: While investigating the request parsing behavior of Django REST Framework (DRF), it was discovered that DRF's high-level parser appears to bypass the Django configuration for protection for and request bodies. Verification: In the test configuration, Django correctly raised a exception, but when the application accessed the data via , DRF successfully parsed the same oversized payload. Root Cause: This behavior occurs because DRF passes the underlying object directly to parsers, which consume the stream via , rather than through the protected path. Impact Scope Affected Versions: Django 3.17.1 CVSS Score: 5.3 / 10 Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low Remediation Recommended Fix: DRF should enforce Django's configuration before passing the raw Django request stream to parsers. This preserves the Django-configured request size protection without requiring broader changes to Django's documented stream interface. POC Code Environment Configuration Python: 3.13 Django: 6.0.7 Django REST Framework: 3.17.1 (Also reproducible on the current upstream main branch) Configuration: Reproduction Steps 1. Create a simple DRF API View: 2. Start the Application: - Send an oversized JSON request: - Example: 3. Observe Results: - HTTP 200: JSON is successfully parsed - Comparison with : - Observation: exception is raised - Comparison with : - Using : - Observation: exception is raised Root Cause Analysis Django documentation defines as the stream interface. DRF exposes as the primary high-level request parsing API. Currently, DRF passes the raw Django request stream directly to parsers before any request size validation occurs. Result: and fully consume the oversized request body, despite the Django-configured request size limit. Security Impact Does NOT introduce: - Authentication bypass - Authorization bypass - Remote Code Execution (RCE) - Information disclosure - Integrity compromise Potential Consequences: - Additional memory allocation during JSON parsing - Additional CPU usage when decoding large JSON payloads - Increased resource consumption when handling oversized request bodies - Reduced effectiveness of Django-configured request size protections on DRF endpoints when using Memory Observations Local testing observed successful parsing of oversized request bodies despite the configured limit. Representative measurements show significantly increased memory allocation when parsing large JSON and urlencoded payloads. Scope Confirmed Affected: - - Confirmed Unaffected: - Version Testing Affected: - Django 6.0.7 + DRF 3.17.1 - Django 6.0.7 + DRF current upstream main Disclosure This behavior has not been publicly disclosed. Submitted privately according to the project's security policy, as there was uncertainty regarding whether the maintainers consider this behavior part of DRF's expected security boundaries. Notes Thank you for taking the time to review this report. If it is determined that this behavior should be addressed, I am willing to conduct further investigation, develop a fix, add regression tests, and submit a patch. With experience as a Python/Django software engineer, security researcher, and open-source contributor, I am keen to contribute to useful fixes.

Goal Reached Thanks to every supporter — we hit 100%!

Django DRF request.data bypasses DATA_UPLOAD_MAX_MEMORY_SIZE for large payloads

More from this source