{"metadata": {"vulnerability": "CVE-2026-73228", "count": 25, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 17}}, "data": [{"timestamp": "2026-08-11T14:41:20.122Z", "date_only": false, "value": "2026-08-11T14:41:20.122Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-73228", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-11T18:54:16.694Z", "date_only": false, "value": "2026-08-11T18:54:16.694Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-73228", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-08-11T18:54:16.694Z", "date_only": false, "value": "2026-08-11T18:54:16.694Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-73228", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-11T19:18:00Z", "date_only": false, "value": "2026-08-11T19:18:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-73228", "record": "UBUNTU-CVE-2026-73228", "field": "published"}, {"timestamp": "2026-08-11T19:18:52Z", "date_only": false, "value": "2026-08-11T19:18:52Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-2M8G-3CMR-WG3W", "record": "GHSA-2M8G-3CMR-WG3W", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-08-11T19:18:52.603Z", "date_only": false, "value": "2026-08-11T19:18:52.603", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73228", "record": "FKIE_CVE-2026-73228", "field": "published"}, {"timestamp": "2026-08-13T13:17:50.209Z", "date_only": false, "value": "2026-08-13T13:17:50.209851Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-73228", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-13T13:17:50.209Z", "date_only": false, "value": "2026-08-13T13:17:50.209851Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73228", "record": "FKIE_CVE-2026-73228", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-13T14:07:46.158Z", "date_only": false, "value": "2026-08-13T14:07:46.158Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-73228", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-13T14:07:46.158Z", "date_only": false, "value": "2026-08-13T14:07:46.158Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-73228", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-27T00:00:00Z", "date_only": false, "value": "2026-08-27T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11625-1", "record": "OPENSUSE-SU-2026:11625-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-08-27T00:00:00Z", "date_only": false, "value": "2026-08-27T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11625-1", "record": "OPENSUSE-SU-2026:11625-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-08-27T00:00:00Z", "date_only": false, "value": "2026-08-27T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11625-1", "record": "OPENSUSE-SU-2026:11625-1", "field": "document.tracking.generator.date"}, {"timestamp": "2026-08-27T00:00:00Z", "date_only": false, "value": "2026-08-27T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11625-1", "record": "OPENSUSE-SU-2026:11625-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-09-01T19:24:51Z", "date_only": false, "value": "2026-09-01T19:24:51Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2M8G-3CMR-WG3W", "record": "GHSA-2M8G-3CMR-WG3W", "field": "published"}, {"timestamp": "2026-09-01T19:24:51Z", "date_only": false, "value": "2026-09-01T19:24:51Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2M8G-3CMR-WG3W", "record": "GHSA-2M8G-3CMR-WG3W", "field": "modified"}, {"timestamp": "2026-09-01T20:33:07.867Z", "date_only": false, "value": "2026-09-01T20:33:07.867348Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/25c48d25038e76519874ccf73ad1c753", "record": "CVE-2026-73228", "field": "creation_timestamp", "uuid": "f904440c-5e39-4377-a717-00d50227d488", "content": "# CVE-2026-73228: CVE-2026-73228: Uncontrolled Resource Consumption (DATA_UPLOAD_MAX_MEMORY_SIZE Bypass) in Django REST Framework\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73228\n\n## Summary\nA vulnerability in Django REST Framework (DRF) before version 3.17.2 allows remote attackers to bypass the native Django DATA_UPLOAD_MAX_MEMORY_SIZE limits. When parsing JSON or URL-encoded request bodies, DRF's JSONParser and FormParser read directly from the low-level HTTP network stream, bypassing Django's high-level request size checks and causing Denial of Service (DoS) via resource exhaustion.\n\n## TL;DR\nDjango REST Framework bypassed Django's native DATA_UPLOAD_MAX_MEMORY_SIZE configuration, letting unauthenticated attackers exhaust system memory and trigger Out-Of-Memory (OOM) crashes by sending massive JSON or URL-encoded payloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400 / CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **Exploit Maturity**: PoC / Functional\n- **CISA KEV**: Not Listed\n- **Affected Component**: rest_framework/request.py (Request._parse)\n\n## Affected Systems\n\n- Django REST Framework (DRF) installations prior to version 3.17.2\n- **django-rest-framework**: < 3.17.2 (Fixed in: `3.17.2`)\n\n## Mitigation\n\n- Upgrade Django REST Framework (DRF) to version 3.17.2 or higher.\n- Configure NGINX or reverse proxy `client_max_body_size` to block large payloads at the network edge.\n- Implement validation middleware that accesses `request.body` explicitly prior to routing to DRF.\n\n**Remediation Steps:**\n1. Update your dependencies using pip (`pip install --upgrade djangorestframework>=3.17.2`) or Poetry (`poetry add djangorestframework@^3.17.2`).\n2. Configure your web server (e.g., NGINX) with `client_max_body_size 5M` inside relevant location blocks to prevent huge requests from hitting the application.\n3. In critical setups, implement custom middleware to enforce body evaluation for incoming application/json and application/x-www-form-urlencoded requests.\n4. Audit any custom DRF parsers that inherit from `BaseParser` to ensure they either subclass the patched `JSONParser` or enforce explicit limits.\n\n## References\n\n- [GitHub Security Advisory GHSA-2m8g-3cmr-wg3w](https://github.com/encode/django-rest-framework/security/advisories/GHSA-2m8g-3cmr-wg3w)\n- [NVD - CVE-2026-73228](https://nvd.nist.gov/vuln/detail/CVE-2026-73228)\n- [DRF Pull Request #10013](https://github.com/encode/django-rest-framework/pull/10013)\n- [DRF Release 3.17.2](https://github.com/encode/django-rest-framework/releases/tag/3.17.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73228) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/25c48d25038e76519874ccf73ad1c753"}, {"timestamp": "2026-09-10T09:44:59Z", "date_only": false, "value": "2026-09-10T09:44:59.000923Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-3827", "record": "PYSEC-2026-3827", "field": "published"}, {"timestamp": "2026-09-10T11:02:05.063Z", "date_only": false, "value": "2026-09-10T11:02:05.063373Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-3827", "record": "PYSEC-2026-3827", "field": "modified"}, {"timestamp": "2026-09-16T20:25:54Z", "date_only": false, "value": "2026-09-16T20:25:54Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11625-1", "record": "OPENSUSE-SU-2026:11625-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-16T21:28:07Z", "date_only": false, "value": "2026-09-16T21:28:07Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11625-1", "record": "OPENSUSE-SU-2026:11625-1", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-09-17T17:21:39Z", "date_only": false, "value": "2026-09-17T17:21:39Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11625-1", "record": "OPENSUSE-SU-2026:11625-1", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-09-17T17:21:39Z", "date_only": false, "value": "2026-09-17T17:21:39Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11625-1", "record": "OPENSUSE-SU-2026:11625-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-17T09:51:13Z", "date_only": false, "value": "2026-10-17T09:51:13Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-73228", "record": "UBUNTU-CVE-2026-73228", "field": "modified"}, {"timestamp": "2026-10-24T15:10:00.190Z", "date_only": false, "value": "2026-10-24T15:10:00.190", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73228", "record": "FKIE_CVE-2026-73228", "field": "lastModified"}]}