## Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

- 種別: advisory
- 重大度: high
- 関連技術: python, django, docker
- CVE: CVE-2026-114138
- 公開日時: 2026-10-22T16:17:13.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-33wh-fxxf-88vv)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-33wh-fxxf-88vv

影響: pip:djangorestframework < 3.18.2 → 3.18.2
DRF's content negotiation parses each Accept token several times per request and never limits the number of tokens or their total size. Each parse ends up in Django's parse_header_parameters, which takes quadratic time when a quoted parameter value is packed with semicolons. On my machine a single GET with a 780KB Accept header made of 96 such tokens kept one gunicorn worker busy for 18.87 seconds (Django 6.1, djangorestframework 3.18.0, gunicorn 26.0.0, Python 3.13, Docker on macOS). The heade…