CVE-2026-114136: Django REST framework: JSONParser applies an attacker-named codec to the request stream
Vulnerability summary
CVE-2026-114136 is a high (CVSS 7.5) vulnerability in encode django-rest-framework. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 43.1% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 21-10-2026PublishedVulnerability first disclosed.
- 30-10-2026Last modifiedVulnerability information updated.
Description
Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec rather than only text encodings. A remote unauthenticated client can therefore cause a compressed JSON request body to be expanded after Django has enforced DATA_UPLOAD_MAX_MEMORY_SIZE against only the wire bytes, allowing a very small request to consume substantial per-worker memory. The default parser set is sufficient, and any reachable endpoint that accepts a JSON body is affected. This issue is fixed in version 3.18.2.
CVSS metrics
6 scores · 6 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.50%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-409Improper Handling of Highly Compressed Data (Data Amplification)The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard8 products
- authentik-2025.12All versions (No fix recorded)
- authentik-2026.2All versions (No fix recorded) | < 2026.2.7-r10
- authentik-fips-2025.12All versions (No fix recorded) | < 2025.12.6-r23
- awxAll versions (No fix recorded) | < 24.6.1-r74
- netboxAll versions (No fix recorded) | < 4.7.3-r2
Debian1 product
- djangorestframeworkAll versions (No fix recorded) | < 3.18.3+ds1-1
Encode1 product
- django-rest-framework≥ 3.6.4, < 3.18.2
PyPI1 product
- djangorestframework≥ 3.6.4, < 3.18.2
Ubuntu1 product
- djangorestframeworkAll versions (No fix recorded)
5 vendors · 12 products
References
9 links- github.com/encode/django-rest-framework/security/advisories/GHSA-3547-9m27-7rxgX Refsource CONFIRMWEBAdvisoryREPORT
- github.com/encode/django-rest-framework/commit/3c2634599b26a9f789b03045118dbc276117611aX Refsource MISCWEBFIXREPORT
