Django REST framework: Denial of Service via Accept header parsing (CVE-2026-114138)

Django REST framework versions prior to 3.18.2 contain a vulnerability in the DefaultContentNegotiation class, specifically within get_accept_list and select_renderer. The framework fails to limit the number and aggregate size of media type tokens in the HTTP Accept header. An attacker can supply a large number of distinct media types containing complex, quoted parameters and excessive semicolons. This forces the server's parser into a cycle of intensive operations that pin synchronous worker threads, leading to service unavailability.

Impact

A remote, unauthenticated attacker can cause a Denial of Service by exhausting synchronous worker threads, rendering the API unresponsive until the malicious requests cease.

Recommendation

• Upgrade Django REST framework to version 3.18.2 or later to include the patch for CVE-2026-114138.
• Implement request-level limits on the size and complexity of HTTP headers at the web server or reverse proxy layer (e.g., nginx, Apache) to mitigate the impact of abnormally large Accept headers before they reach the application tier.