Django REST framework: JSONParser applies an attacker-named codec to the request stream

影響: pip:djangorestframework >= 3.6.4, < 3.18.2 → 3.18.2

An unauthenticated attacker can defeat Django's DATA_UPLOAD_MAX_MEMORY_SIZE limit and force a worker process to allocate arbitrary memory, by naming a compression codec in the Content-Type charset parameter. A 108-byte request body produces a 50,331,648-character value inside the view, an amplification factor of 466,033, and grows process peak RSS by about 97 MiB. No application configuration is required beyond DRF's default parser set; the endpoint only has to accept a JSON body. Details JSONP…

GitHub Advisory Database에서 읽기

2026. 10. 23. 오전 01:16, GitHub Advisory Database에서 "Django REST framework: JSONParser applies an attacker-named codec to the request stream"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Python, Django. CVE: CVE-2026-114136.