DEBIAN-CVE-2026-114136
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-114136
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114136.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-114136
- Upstream
- Published
- 2026-10-22T20:47:45Z
- Modified
- 2026-10-22T21:00:07Z
- Summary
- [none]
- Details
-
Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec rather than only text encodings. A remote unauthenticated client can therefore cause a compressed JSON request body to be expanded after Django has enforced DATA_UPLOAD_MAX_MEMORY_SIZE against only the wire bytes, allowing a very small request to consume substantial per-worker memory. The default parser set is sufficient, and any reachable endpoint that accepts a JSON body is affected. This issue is fixed in version 3.18.2.
- References
Affected packages
Debian:12 / djangorestframework
Package
- Name
- djangorestframework
- Purl
- pkg:deb/debian/djangorestframework?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:13 / djangorestframework
Package
- Name
- djangorestframework
- Purl
- pkg:deb/debian/djangorestframework?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / djangorestframework
Package
- Name
- djangorestframework
- Purl
- pkg:deb/debian/djangorestframework?arch=source&distro=forky