Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

影響: pip:djangorestframework < 3.18.2 → 3.18.2

DRF's content negotiation parses each Accept token several times per request and never limits the number of tokens or their total size. Each parse ends up in Django's parse_header_parameters, which takes quadratic time when a quoted parameter value is packed with semicolons. On my machine a single GET with a 780KB Accept header made of 96 such tokens kept one gunicorn worker busy for 18.87 seconds (Django 6.1, djangorestframework 3.18.0, gunicorn 26.0.0, Python 3.13, Docker on macOS). The heade…

在 GitHub Advisory Database 阅读

2026/10/23 01:17，GitHub Advisory Database 发布了“Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Python、Django、Docker。CVE：CVE-2026-114138。