CVE-2026-73228

Medium

Description

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.

SeverityMedium

CVSS5.3

Exploit probability—

ProductDjangorestframework

PublishedAug 11, 2026

First seenAug 11, 2026

Weakness typeCWE-400Uncontrolled resource consumption CWE-770Allocation of resources without limits

How to fix

Update

djangorestframework3.17.2 or later

Affected products

Product	Affected versions	Fixed in
djangorestframeworkPyPI	v < 3.17.2	3.17.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.