encode Django REST Framework up to 3.18.1 JSONParser parsers.py JSONParser.parse resource consumption

Summaryinfo

A vulnerability was found in encode Django REST Framework up to 3.18.1 and classified as problematic. This vulnerability affects the function JSONParser.parse of the file rest_framework/parsers.py of the component JSONParser. Such manipulation leads to resource consumption. This vulnerability is listed as CVE-2026-114136. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in encode Django REST Framework up to 3.18.1. It has been rated as problematic. Affected by this issue is the function JSONParser.parse of the file rest_framework/parsers.py of the component JSONParser. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. CVE summarizes:

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec rather than only text encodings. A remote unauthenticated client can therefore cause a compressed JSON request body to be expanded after Django has enforced DATA_UPLOAD_MAX_MEMORY_SIZE against only the wire bytes, allowing a very small request to consume substantial per-worker memory. The default parser set is sufficient, and any reachable endpoint that accepts a JSON body is affected. This issue is fixed in version 3.18.2.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-114136 since 10/20/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 3.18.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-107546). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• encode

Name

• Django REST Framework

Version

• 3.18.0
• 3.18.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion