{"id":"DEBIAN-CVE-2026-114136","details":"Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec rather than only text encodings. A remote unauthenticated client can therefore cause a compressed JSON request body to be expanded after Django has enforced DATA_UPLOAD_MAX_MEMORY_SIZE against only the wire bytes, allowing a very small request to consume substantial per-worker memory. The default parser set is sufficient, and any reachable endpoint that accepts a JSON body is affected. This issue is fixed in version 3.18.2.","modified":"2026-10-22T21:00:07.746806997Z","published":"2026-10-22T20:47:45.385085750Z","upstream":["CVE-2026-114136"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-114136"}],"affected":[{"package":{"name":"djangorestframework","ecosystem":"Debian:12","purl":"pkg:deb/debian/djangorestframework?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.0-2","3.14.0-2+deb12u1","3.15.1-1","3.15.1-2","3.15.2-1","3.15.2-2","3.16.0-1","3.16.1-1","3.16.1-3","3.16.1-4","3.17.1+ds1-1","3.17.1-1","3.18.1+ds1-1","3.18.3+ds1-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114136.json"}},{"package":{"name":"djangorestframework","ecosystem":"Debian:13","purl":"pkg:deb/debian/djangorestframework?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.0-1","3.16.1-1","3.16.1-3","3.16.1-4","3.17.1+ds1-1","3.17.1-1","3.18.1+ds1-1","3.18.3+ds1-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114136.json"}},{"package":{"name":"djangorestframework","ecosystem":"Debian:14","purl":"pkg:deb/debian/djangorestframework?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.3+ds1-1"}]}],"versions":["3.16.0-1","3.16.1-1","3.16.1-3","3.16.1-4","3.17.1+ds1-1","3.17.1-1","3.18.1+ds1-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-114136.json"}}],"schema_version":"1.9.0"}