CVE-2026-73228: Django REST Framework DoS Vulnerability

CVE-2026-73228 Overview

CVE-2026-73228 affects Django REST Framework (DRF) versions prior to 3.17.2. The vulnerability exists in rest_framework/request.py where the Request._parse() method passes the underlying HttpRequest stream directly to JSONParser and FormParser for application/json and application/x-www-form-urlencoded request bodies. This bypasses Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection. Attackers can submit oversized request bodies to consume additional memory and CPU on the target server. The issue is classified as a resource exhaustion weakness [CWE-400] and is fixed in version 3.17.2.

Critical Impact
Unauthenticated remote attackers can send oversized JSON or form-encoded bodies to DRF endpoints to exhaust server memory and CPU, degrading application availability.

Affected Products

Django REST Framework versions prior to 3.17.2
Applications using DRF JSONParser for application/json request bodies
Applications using DRF FormParser for application/x-www-form-urlencoded request bodies

Discovery Timeline

2026-08-11 - CVE-2026-73228 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73228

Vulnerability Analysis

Django provides the DATA_UPLOAD_MAX_MEMORY_SIZE setting to cap the size of request bodies loaded into memory. This protection prevents unbounded resource consumption from oversized HTTP payloads. Django REST Framework's request wrapper subverts this control by handing the raw HttpRequest stream directly to its parsers. The parsers then read the full stream without honoring the Django-level size ceiling. As a result, JSON and form-encoded request bodies of arbitrary size can be parsed into memory, driving up memory allocation and CPU utilization on the application server.

Root Cause

The root cause resides in the Request._parse() method of rest_framework/request.py. When DRF selects JSONParser or FormParser, the parser receives the underlying stream rather than a bounded buffer constructed from self.body, which is subject to Django's upload size checks. The fix wraps the body in io.BytesIO(self.body) before parsing, ensuring Django's size enforcement runs first.

Attack Vector

Exploitation requires only network access to a DRF endpoint that accepts JSON or form-encoded input. No authentication or user interaction is needed. An attacker sends HTTP requests with Content-Type: application/json or application/x-www-form-urlencoded and an oversized body. Repeated requests amplify memory and CPU pressure, producing a denial-of-service condition against the API.

python

         if not parser:
             raise exceptions.UnsupportedMediaType(media_type)
 
+        from rest_framework.parsers import FormParser, JSONParser
+        if isinstance(parser, (JSONParser, FormParser)):
+            stream = io.BytesIO(self.body)
+
         try:
             parsed = parser.parse(stream, media_type, self.parser_context)
         except Exception:

Source: GitHub commit 2912dc9. The patch routes JSON and form parsing through self.body, which triggers Django's DATA_UPLOAD_MAX_MEMORY_SIZE enforcement before the parser consumes the stream.

Detection Methods for CVE-2026-73228

Indicators of Compromise

HTTP POST or PUT requests to DRF endpoints with unusually large Content-Length values targeting application/json or application/x-www-form-urlencoded handlers.
Sustained spikes in worker process memory usage or CPU on Django application servers without corresponding traffic increases.
Application errors, worker restarts, or out-of-memory kills correlating with API request patterns.

Detection Strategies

Inspect access logs and Web Application Firewall (WAF) telemetry for requests exceeding expected body-size baselines on DRF routes.
Correlate slow response times and 5xx error rates with request bodies larger than the intended DATA_UPLOAD_MAX_MEMORY_SIZE value.
Audit application dependencies to identify DRF installations prior to version 3.17.2.

Monitoring Recommendations

Ship reverse proxy and application logs to a centralized analytics platform and alert on Content-Length outliers per endpoint.
Monitor Django worker memory and CPU with per-request tagging to attribute resource growth to specific API calls.
Track cumulative request-body bytes per source IP and rate-limit sources exceeding thresholds.

How to Mitigate CVE-2026-73228

Immediate Actions Required

Upgrade Django REST Framework to version 3.17.2 or later across all deployments.
Enforce request body size limits at the reverse proxy or ingress layer (for example, nginx client_max_body_size) as defense in depth.
Apply rate limiting on unauthenticated API endpoints that accept JSON or form-encoded bodies.

Patch Information

The fix is available in Django REST Framework 3.17.2. Review the GitHub Security Advisory GHSA-2m8g-3cmr-wg3w and pull request #10013 for full details. The patched commits are 2912dc9 and 82ef7b7.

Workarounds

Terminate oversized requests at the upstream proxy (nginx, HAProxy, or an API gateway) before they reach the Django worker.
Restrict accepted content types on API endpoints where JSON or form input is not required.
Deploy request-body size validation middleware ahead of DRF parsers if immediate upgrade is not feasible.

bash

# nginx defense-in-depth: cap request body size before it reaches Django
http {
    client_max_body_size 2m;
    client_body_buffer_size 128k;
}

# Django settings.py: ensure DATA_UPLOAD_MAX_MEMORY_SIZE is set
# (default 2621440 bytes = 2.5 MB)
DATA_UPLOAD_MAX_MEMORY_SIZE = 2621440