Brief Security & Trust · October 22, 2026

Django REST framework flaw lets a 108-byte request swell to 50 million characters

The GitHub Advisory Database says one small, unauthenticated JSON request can grow far past Django's size limit.

In brief

The GitHub Advisory Database says an attacker with no login can bypass Django's request size limit in Django REST framework. A 108-byte body grew to 50,331,648 characters.
The advisory says versions 3.6.4 and later are affected with default settings. It links a 3.18.2 release but does not say what that release changes.

The GitHub Advisory Database said on 22 October 2026 that Django REST framework (DRF), a toolkit for building web APIs, has a memory flaw. An attacker with no login can name a compression format in the charset part of a request's Content-Type header. DRF's JSON parser then unpacks the body. In the advisory's test, a 108-byte body became 50,331,648 characters, and the process's peak memory rose by about 97 MiB.

Django's upload limit counts the bytes that arrive. DRF's parser unpacks the data afterwards, when nothing is counting. The advisory says DRF 3.6.4 and later are affected with default settings. It says the form and multipart parsers refuse the same trick. It links CVE-2026-114136 and a DRF 3.18.2 release page, but does not say what that release changes.

A limit that measures the wrong moment is not a protection. The advisory rates the harm as lost availability only, since memory is freed after each request, but says a few concurrent requests could exhaust a worker. Leaders can ask their teams which DRF version they run, whether any cap in front of the app counts the unpacked size, and who tracks the fix.

A WebPulse Brief: a short report of an important event, written by the WebPulse Newsroom with AI assistance and checked against the reporting below. When there is more to explain, we follow up with a full story. How we use AI.

Reporting: GitHub Advisory Database.