Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
encode:django-rest-framework
References 4
https://github.com/encode/django-rest-framework/security/advisories/GHSA-2m8g-3…
https://github.com/encode/django-rest-framework/security/advisories/GHSA-2m8g-3cmr-wg3w
https://github.com/encode/django-rest-framework/pull/10013
https://github.com/encode/django-rest-framework/pull/10013
https://github.com/encode/django-rest-framework/commit/2912dc98042f78e27636551f…
https://github.com/encode/django-rest-framework/commit/2912dc98042f78e27636551fc22eeaf10f725fdd
https://github.com/encode/django-rest-framework/commit/82ef7b7e4e0a73ba5c489b46…
https://github.com/encode/django-rest-framework/commit/82ef7b7e4e0a73ba5c489b465fae7e76d948da4e