Patch DRF 3.18.2 to Block Unauthenticated Memory Exhaustion via Codec Manipulation

Security teams must immediately verify their Django Rest Framework versions and apply the patch to 3.18.2 to prevent unauthenticated memory exhaustion attacks. This high-severity vulnerability, identified as CVE-2026-114136, allows attackers to bypass standard data upload limits by manipulating content-type headers. The issue affects Django Rest Framework versions starting from 3.6.4 up to, but not including, 3.18.2. According to the GitHub advisory GHSA-3547-9m27-7rxg, the flaw is rated high severity due to its potential to crash services through resource exhaustion.

The risk

An unauthenticated attacker can defeat Django's `DATA_UPLOAD_MAX_MEMORY_SIZE` limit by specifying a compression codec in the Content-Type charset parameter. This forces a worker process to allocate arbitrary amounts of memory. A request body of just 108 bytes produces a 50,331,648-character value inside the view. This results in an amplification factor of 466,033 and grows the process peak resident set size by about 97 MiB. No application configuration is required beyond DRF's default parser set.

Who is exposed

The vulnerability affects any endpoint that accepts a JSON body and uses the default parser settings. The defect lies within Django Rest Framework, not Django itself. Django resolves the charset parameter and assigns `request.encoding`, but the issue occurs when `JSONParser.parse` decodes the request body. It uses the charset supplied by the client on the Content-Type header. This allows byte transforms like `bz2_codec` or `zlib_codec` to wrap the stream before parsing.

Cost and compliance

The source material does not provide specific financial cost estimates or regulatory compliance implications for this vulnerability. The advisory focuses on the technical mechanism of the memory exhaustion and the specific version ranges affected. Organizations should review their own compliance requirements regarding software maintenance and vulnerability management to determine how this high-severity flaw impacts their obligations.

Our take on the response

The availability of a patched version (3.18.2) provides a clear remediation path for affected environments. Teams should prioritize updating Django Rest Framework instances that expose JSON endpoints to unauthenticated users. Given the high amplification factor, even low-volume attacks can cause significant service disruption, making timely patching essential for maintaining availability.

What defenders should look for

Teams usually detect this activity by monitoring for unusual spikes in worker process memory usage that do not correlate with network traffic volume. Check whether logs show requests with non-standard charset parameters in Content-Type headers, such as codec names. Look for alerts indicating rapid growth in resident set size for API workers. Containment moves typically involve rate-limiting requests with unusual content types or blocking specific charset values at the web server level until patches are applied.

Background: Vulnerability management programs

A vulnerability management program is a structured process for finding, assessing, and fixing security flaws in your systems. It moves beyond simple scanning to prioritize risks based on context, ensuring that the most dangerous weaknesses are addressed first to reduce the overall attack surface.

Read the full guide: Vulnerability Management Programs: Definition, Purpose, and Core Mechanics

What to do and how to stay safe: Django Rest Framework

• Audit your inventory to identify all systems running Django Rest Framework versions between 3.6.4 and 3.18.1.
• Upgrade vulnerable instances to version 3.18.2 or later once the vendor provides an update.
• Monitor application logs for Content-Type headers containing unexpected charset values or codec names.
• Review worker process memory metrics for sudden, unexplained increases that could indicate decompression attacks.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Django Rest Framework versions are vulnerable to CVE-2026-114136?

Versions 3.6.4 and above, up to but not including 3.18.2, are vulnerable to this memory exhaustion flaw.

Does this vulnerability require authentication to exploit?

No, the advisory states that an unauthenticated attacker can exploit this flaw by sending a crafted request.

How much memory can a single request consume?

A 108-byte request can grow process peak RSS by about 97 MiB through significant data amplification.