CVE-2026-114138: Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
Vulnerability summary
CVE-2026-114138 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in encode django-rest-framework. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 48.4% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 21-10-2026PublishedVulnerability first disclosed.
- 28-10-2026Last modifiedVulnerability information updated.
Description
Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer in that file repeatedly invokes _MediaType parsing from rest_framework/utils/mediatypes.py for each attacker-controlled token, every renderer, and forced 406 renegotiation. A remote unauthenticated client can send many distinct media types containing large quoted parameter values with numerous semicolons, causing Django's parameter parser and DRF's repeated parsing structure to consume disproportionate CPU. Requests to any reachable endpoint can pin synchronous workers for prolonged periods, and concurrent requests can make the service unavailable until the requests stop. This issue is fixed in version 3.18.2.
CVSS metrics
6 scores · 6 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard8 products
- authentik-2025.12All versions (No fix recorded)
- authentik-2026.2All versions (No fix recorded) | < 2026.2.7-r10
- authentik-fips-2025.12All versions (No fix recorded) | < 2025.12.6-r23
- awxAll versions (No fix recorded) | < 24.6.1-r74
- netboxAll versions (No fix recorded) | < 4.7.3-r2
Debian1 product
- djangorestframeworkAll versions (No fix recorded) | < 3.18.3+ds1-1
Encode1 product
- django-rest-framework< 3.18.2
PyPI1 product
- djangorestframework< 3.18.2
Ubuntu1 product
- djangorestframeworkAll versions (No fix recorded)
5 vendors · 12 products
References
9 links- github.com/encode/django-rest-framework/security/advisories/GHSA-33wh-fxxf-88vvX Refsource CONFIRMWEBAdvisoryREPORT
- github.com/encode/django-rest-framework/commit/148ab6523922d5a0c110f76615935e5220b63029X Refsource MISCWEBFIXREPORT
