CVE-2026-73228: Request Parsing Size-Limit Bypass in Django REST Framework
Django's DATA_UPLOAD_MAX_MEMORY_SIZE setting is designed to limit how much request-body data is loaded into memory. While investigating request parsing behavior in Django REST Framework (DRF), I found that this protection was not consistently enforced when applications accessed request data through DRF's high-level request.data API. The issue was reported responsibly and was later published as…
A security flaw, labeled CVE-2026-73228, was discovered in Django REST Framework (DRF) regarding how it handles large request bodies. The vulnerability stems from DRF's handling of request data through its high-level `request.data` API, which did not consistently enforce the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting that limits request-body size. This inconsistency arose because DRF could access the underlying Django request through a lower-level stream interface, bypassing the configured size limit.
The issue was reported to Django, and a patch was released in version 3.17.2. The vulnerability, classified as moderate severity (CVSS 3.1: 5.3), mainly impacts DRF's parsing of JSON and URL-encoded data. Accessing oversized requests via `request.data` would be successful, while the same oversized requests failed when accessed through `request.body` due to the size limit. This discrepancy could lead to resource consumption, potentially impacting availability.
The root cause lies in the abstraction boundaries between Django's request handling and DRF's higher-level request parsing. DRF's parser could consume the request stream before the size validation occurred, allowing oversized requests to bypass the configured limit. The fix ensures that the size protection is enforced before the parser accesses the request data, maintaining the intended security controls.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.