Django REST framework: JSONParser applies attacker-named codec to request stream, defeating DATA_UPLOAD_MAX_MEMORY_SIZE (CVE-2026-114136)
Severity: high · Patch status: patched · Since 2026-10-06 · CVE-2026-114136
A public advisory (GHSA-3547-9m27-7rxg, published 2026-10-06, updated 2026-10-22) describes a flaw in DRF's JSONParser, which decodes the request body using the client-supplied Content-Type charset via codecs.getreader — the only codecs entry point that accepts byte-transform codecs like bz2codec and zlibcodec. An unauthenticated attacker can send a ~108-byte compressed body with charset=bz2codec, which decompresses inside the parser after Django's DATAUPLOADMAXMEMORYSIZE check, yielding a 50,331,648-character value (~466,033x amplification, ~97 MiB peak RSS growth) and enabling trivial memory-exhaustion DoS with no special configuration. The bug was introduced in 3.6.4 (2017). Fixed in 3.18.2 by rejecting non-text encodings; a public PoC exists but no in-the-wild exploitation is reported.
What to do
- Upgrade djangorestframework to 3.18.2 or later
- As interim mitigation, reject or strip charset parameters on Content-Type headers for JSON endpoints (e.g., at the reverse proxy/WAF), or restrict allowed charsets in a custom parser
- Review rate-limiting and body-size limits at the proxy layer to blunt memory-exhaustion DoS against JSON endpoints
- Monitor worker memory and alert on anomalous RSS growth on DRF services
Fixed versions
Sources
All live incidents on Threat Watch
