CVE-2026-73228: CVE-2026-73228: Uncontrolled Resource Consumption (DATA_UPLOAD_MAX_MEMORY_SIZE Bypass) in Django REST Framework

CVE-2026-73228: Uncontrolled Resource Consumption (DATA_UPLOAD_MAX_MEMORY_SIZE Bypass) in Django REST Framework

Vulnerability ID: CVE-2026-73228
CVSS Score: 5.3
Published: 2026-09-01

A vulnerability in Django REST Framework (DRF) before version 3.17.2 allows remote attackers to bypass the native Django DATA_UPLOAD_MAX_MEMORY_SIZE limits. When parsing JSON or URL-encoded request bodies, DRF's JSONParser and FormParser read directly from the low-level HTTP network stream, bypassing Django's high-level request size checks and causing Denial of Service (DoS) via resource exhaustion.

TL;DR

Django REST Framework bypassed Django's native DATA_UPLOAD_MAX_MEMORY_SIZE configuration, letting unauthenticated attackers exhaust system memory and trigger Out-Of-Memory (OOM) crashes by sending massive JSON or URL-encoded payloads.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-400 / CWE-770
• Attack Vector: Network (AV:N)
• CVSS Score: 5.3 (Medium)
• Exploit Maturity: PoC / Functional
• CISA KEV: Not Listed
• Affected Component: rest_framework/request.py (Request._parse)

Affected Systems

• Django REST Framework (DRF) installations prior to version 3.17.2
• django-rest-framework: < 3.17.2 (Fixed in: 3.17.2)

Code Analysis

Commit: 2912dc9

Fix: Enforce DATA_UPLOAD_MAX_MEMORY_SIZE for JSON/Form parsers

Commit: 82ef7b7

Merge and cleanup of DATA_UPLOAD_MAX_MEMORY_SIZE bypass fix

Mitigation Strategies

• Upgrade Django REST Framework (DRF) to version 3.17.2 or higher.
• Configure NGINX or reverse proxy client_max_body_size to block large payloads at the network edge.
• Implement validation middleware that accesses request.body explicitly prior to routing to DRF.

Remediation Steps:

1. Update your dependencies using pip (pip install --upgrade djangorestframework>=3.17.2) or Poetry (poetry add djangorestframework@^3.17.2).
2. Configure your web server (e.g., NGINX) with client_max_body_size 5M inside relevant location blocks to prevent huge requests from hitting the application.
3. In critical setups, implement custom middleware to enforce body evaluation for incoming application/json and application/x-www-form-urlencoded requests.
4. Audit any custom DRF parsers that inherit from BaseParser to ensure they either subclass the patched JSONParser or enforce explicit limits.

References

• GitHub Security Advisory GHSA-2m8g-3cmr-wg3w
• NVD - CVE-2026-73228
• DRF Pull Request #10013
• DRF Release 3.17.2

---

Read the full report for CVE-2026-73228 on our website for more details including interactive diagrams and full exploit analysis.