https://vulnerability.circl.lu/sightings/feed 2026-09-02T23:12:37.536857+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/f904440c-5e39-4377-a717-00d50227d488/export 2026-09-02T23:12:37.564948+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "f904440c-5e39-4377-a717-00d50227d488", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73228", "type": "seen", "source": "https://gist.github.com/alon710/25c48d25038e76519874ccf73ad1c753", "content": "# CVE-2026-73228: CVE-2026-73228: Uncontrolled Resource Consumption (DATA_UPLOAD_MAX_MEMORY_SIZE Bypass) in Django REST Framework\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73228\n\n## Summary\nA vulnerability in Django REST Framework (DRF) before version 3.17.2 allows remote attackers to bypass the native Django DATA_UPLOAD_MAX_MEMORY_SIZE limits. When parsing JSON or URL-encoded request bodies, DRF's JSONParser and FormParser read directly from the low-level HTTP network stream, bypassing Django's high-level request size checks and causing Denial of Service (DoS) via resource exhaustion.\n\n## TL;DR\nDjango REST Framework bypassed Django's native DATA_UPLOAD_MAX_MEMORY_SIZE configuration, letting unauthenticated attackers exhaust system memory and trigger Out-Of-Memory (OOM) crashes by sending massive JSON or URL-encoded payloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400 / CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **Exploit Maturity**: PoC / Functional\n- **CISA KEV**: Not Listed\n- **Affected Component**: rest_framework/request.py (Request._parse)\n\n## Affected Systems\n\n- Django REST Framework (DRF) installations prior to version 3.17.2\n- **django-rest-framework**: < 3.17.2 (Fixed in: `3.17.2`)\n\n## Mitigation\n\n- Upgrade Django REST Framework (DRF) to version 3.17.2 or higher.\n- Configure NGINX or reverse proxy `client_max_body_size` to block large payloads at the network edge.\n- Implement validation middleware that accesses `request.body` explicitly prior to routing to DRF.\n\n**Remediation Steps:**\n1. Update your dependencies using pip (`pip install --upgrade djangorestframework>=3.17.2`) or Poetry (`poetry add djangorestframework@^3.17.2`).\n2. Configure your web server (e.g., NGINX) with `client_max_body_size 5M` inside relevant location blocks to prevent huge requests from hitting the application.\n3. In critical setups, implement custom middleware to enforce body evaluation for incoming application/json and application/x-www-form-urlencoded requests.\n4. Audit any custom DRF parsers that inherit from `BaseParser` to ensure they either subclass the patched `JSONParser` or enforce explicit limits.\n\n## References\n\n- [GitHub Security Advisory GHSA-2m8g-3cmr-wg3w](https://github.com/encode/django-rest-framework/security/advisories/GHSA-2m8g-3cmr-wg3w)\n- [NVD - CVE-2026-73228](https://nvd.nist.gov/vuln/detail/CVE-2026-73228)\n- [DRF Pull Request #10013](https://github.com/encode/django-rest-framework/pull/10013)\n- [DRF Release 3.17.2](https://github.com/encode/django-rest-framework/releases/tag/3.17.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73228) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-01T20:33:07.867348Z"} 2026-09-01T20:33:07.867348+00:00