DEBIAN-CVE-2026-73228

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-73228
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-73228.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-73228
Upstream
Published
2026-08-11T19:18:52Z
Modified
2026-09-12T08:47:23Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
[none]
Details

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.

References

Affected packages

Debian:12 / djangorestframework

Package

Name
djangorestframework
Purl
pkg:deb/debian/djangorestframework?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.14.0-2
3.14.0-2+deb12u1
3.15.1-1
3.15.1-2
3.15.2-1
3.15.2-2
3.16.0-1
3.16.1-1
3.16.1-3
3.16.1-4
3.17.1-1
3.17.1+ds1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-73228.json"

Debian:13 / djangorestframework

Package

Name
djangorestframework
Purl
pkg:deb/debian/djangorestframework?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.16.0-1
3.16.1-1
3.16.1-3
3.16.1-4
3.17.1-1
3.17.1+ds1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-73228.json"

Debian:14 / djangorestframework

Package

Name
djangorestframework
Purl
pkg:deb/debian/djangorestframework?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.16.0-1
3.16.1-1
3.16.1-3
3.16.1-4
3.17.1-1
3.17.1+ds1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-73228.json"