Django Rest Framework

このタグに関連する脆弱性 3

• 高 7.5 Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer in that file repeatedly invokes _MediaType parsing from rest_fr... CVE-2026-114138 5:09
• 高 7.4 Django REST framework: TokenProxy.delete() reports success and revokes nothing Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and repor... CVE-2026-114137 5:06
• 高 7.5 Django REST framework: JSONParser applies an attacker-named codec to the request stream Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec rather than only text encodings. A remote... CVE-2026-114136 5:02