Medium [CVE-2026-73228] Django REST framework: Denial of Service via oversized request bodies

Django REST framework is a toolkit for building Web APIs.

Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU.

This issue is fixed in version 3.17.2. This allows an attacker to send oversized JSON and URL-encoded request bodies, leading to excessive consumption of memory and CPU resources.

This could result in a Denial of Service (DoS) for the affected application.

This vulnerability is rated as having a Moderate impact because, while unauthenticated remote clients can submit large payloads to drive excessive processing and memory consumption, the flaw is confined to resource exhaustion without compromising system confidentiality or data integrity.

In Red Hat environments, such as Ansible Automation Platform and Satellite, the vulnerable framework is embedded within backend services to handle API requests. The overall exposure is limited by standard deployment topologies, where services operate behind network boundaries or API gateways that restrict incoming traffic.

Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).