{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3adjango-rest-frameworkdjango_rest_framework/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:django-rest-framework:django_rest_framework:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-114138"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Django REST framework (\u003c 3.18.2)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Django Software Foundation"],"content_html":"\u003cp\u003eDjango REST framework versions prior to 3.18.2 contain a vulnerability in the \u003ccode\u003eDefaultContentNegotiation\u003c/code\u003e class, specifically within \u003ccode\u003eget_accept_list\u003c/code\u003e and \u003ccode\u003eselect_renderer\u003c/code\u003e. The framework fails to limit the number and aggregate size of media type tokens in the HTTP \u003ccode\u003eAccept\u003c/code\u003e header. An attacker can supply a large number of distinct media types containing complex, quoted parameters and excessive semicolons. This forces the server's parser into a cycle of intensive operations that pin synchronous worker threads, leading to service unavailability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA remote, unauthenticated attacker can cause a Denial of Service by exhausting synchronous worker threads, rendering the API unresponsive until the malicious requests cease.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Django REST framework to version 3.18.2 or later to include the patch for CVE-2026-114138.\u003c/li\u003e\n\u003cli\u003eImplement request-level limits on the size and complexity of HTTP headers at the web server or reverse proxy layer (e.g., nginx, Apache) to mitigate the impact of abnormally large \u003ccode\u003eAccept\u003c/code\u003e headers before they reach the application tier.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T21:41:30Z","date_published":"2026-10-21T21:41:30Z","id":"https://feed.craftedsignal.io/briefs/2026-10-django-rest-framework-dos/","summary":"Django REST framework versions prior to 3.18.2 are susceptible to a Denial of Service attack where specially crafted Accept headers cause CPU-intensive parsing and thread exhaustion.","title":"Django REST framework: Denial of Service via Accept header parsing (CVE-2026-114138)","url":"https://feed.craftedsignal.io/briefs/2026-10-django-rest-framework-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:django-Rest-Framework:django_rest_framework:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}