CVE-2026-73228 Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`
Attackers can bypass memory limits to cause resource exhaustion via oversized JSON or form data in Django REST framework APIs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73228?
CVE-2026-73228 is a medium-severity denial of service vulnerability in encode django-rest-framework, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.
Which versions are affected by CVE-2026-73228?
3 open source packages ship an affected version, including djangorestframework.
| Package | Affected | Fixed in |
|---|---|---|
djangorestframework PyPI | All versions | 3.17.2 |
djangorestframework PyPI | All versions | 3.17.2 |
djangorestframework PyPI | All versions | 3.17.2 |
Linux distribution packages (1)
python-djangorestframework openSUSE:Tumbleweed | All versions | 3.18.0-2.1 |
How do I fix CVE-2026-73228?
Upgrade djangorestframework to 3.17.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-73228 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73228 exists.
Sources
Also known as DEBIAN-CVE-2026-73228, ECHO-e877-aae8-61ca, GHSA-2m8g-3cmr-wg3w, MINI-65h5-7cjw-xrwh, PYSEC-2026-3827, UBUNTU-CVE-2026-73228 and 1 more.