CVE-2026-73228: encode django-rest-framework Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-73228 is a medium (CVSS 5.3) Uncontrolled Resource Consumption vulnerability in encode django-rest-framework. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 11-08-2026PublishedVulnerability first disclosed.
- 13-08-2026Last modifiedVulnerability information updated.
Description
Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
+0.17 pp
From 0.39% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Chainguard9 products
- authentik-2025.12All versions (No fix recorded)
- authentik-2026.2All versions (No fix recorded)
- authentik-2026.5< 2026.5.6-r17
- authentik-fips-2025.12All versions (No fix recorded)
- authentik-fips-2026.2< 2026.2.6-r20
Debian1 product
- djangorestframeworkAll versions (No fix recorded) | < 3.18.1+ds1-1
Encode1 product
- django-rest-framework< 3.17.2
Opensuse1 product
- python-djangorestframework&distro=openSUSE Tumbleweed< 3.18.0-2.1
PyPI1 product
- djangorestframework< 3.17.2
Ubuntu1 product
- djangorestframeworkAll versions (No fix recorded)
6 vendors · 14 products
References
14 links- github.com/encode/django-rest-framework/security/advisories/GHSA-2m8g-3cmr-wg3wX Refsource CONFIRMWEBREPORTAdvisory
- github.com/encode/django-rest-framework/commit/2912dc98042f78e27636551fc22eeaf10f725fddX Refsource MISCWEBREPORTFIX
- github.com/encode/django-rest-framework/commit/82ef7b7e4e0a73ba5c489b465fae7e76d948da4eX Refsource MISCWEBREPORTFIX
