{"id":"ghsa-ghsa-3547-9m27-7rxg","seq":309584,"kind":"advisory","title":"Django REST framework: JSONParser applies an attacker-named codec to the request stream","url":"https://github.com/advisories/GHSA-3547-9m27-7rxg","permalink":"https://vulnpulse.app/items/ghsa-ghsa-3547-9m27-7rxg","summary":"影響: pip:djangorestframework >= 3.6.4, < 3.18.2 → 3.18.2\nAn unauthenticated attacker can defeat Django's DATA_UPLOAD_MAX_MEMORY_SIZE limit and force a worker process to allocate arbitrary memory, by naming a compression codec in the Content-Type charset parameter. A 108-byte request body produces a 50,331,648-character value inside the view, an amplification factor of 466,033, and grows process peak RSS by about 97 MiB. No application configuration is required beyond DRF's default parser set; the endpoint only has to accept a JSON body. Details JSONP…","severity":"high","techs":["python","django"],"cves":["CVE-2026-114136"],"tags":["GHSA-3547-9m27-7rxg","djangorestframework"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:16:09.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}