{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/django-rest-framework--3.6.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Django REST framework (\u003e= 3.6.4)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Django REST framework"],"content_html":"\u003cp\u003eDjango REST framework (DRF) versions 3.6.4 and later contain a vulnerability in \u003ccode\u003eJSONParser\u003c/code\u003e where the \u003ccode\u003eContent-Type\u003c/code\u003e charset parameter is used to apply arbitrary codecs to the request stream. Because DRF does not verify if the requested charset is a valid text encoding, an attacker can specify byte-transform codecs like \u003ccode\u003ebz2_codec\u003c/code\u003e or \u003ccode\u003ezlib_codec\u003c/code\u003e. This results in the request body being decompressed into memory before the \u003ccode\u003eDATA_UPLOAD_MAX_MEMORY_SIZE\u003c/code\u003e check is performed, allowing for massive memory expansion.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a highly compressed malicious JSON payload (e.g., 108 bytes).\u003c/li\u003e\n\u003cli\u003eAttacker initiates a POST request to a DRF endpoint accepting JSON.\u003c/li\u003e\n\u003cli\u003eAttacker sets the \u003ccode\u003eContent-Type\u003c/code\u003e header to \u003ccode\u003eapplication/json; charset=bz2_codec\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDjango receives the request and initializes \u003ccode\u003eJSONParser\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eJSONParser\u003c/code\u003e calls \u003ccode\u003ecodecs.getreader()\u003c/code\u003e with the attacker-provided \u003ccode\u003ebz2_codec\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe request stream is decompressed into memory by the codec reader.\u003c/li\u003e\n\u003cli\u003eThe expanded data is passed to \u003ccode\u003ejson.load()\u003c/code\u003e while the original \u003ccode\u003eDATA_UPLOAD_MAX_MEMORY_SIZE\u003c/code\u003e check remains satisfied by the small wire-size of the payload.\u003c/li\u003e\n\u003cli\u003eThe worker process consumes significant memory, potentially causing a Denial of Service (DoS).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an amplification factor of over 400,000x, where a 108-byte request can force the allocation of ~50 MiB of memory, significantly increasing process peak RSS and facilitating memory-based DoS.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePatch the \u003ccode\u003eJSONParser\u003c/code\u003e to validate that the provided encoding is a supported text-based encoding. Implement the following check within \u003ccode\u003erest_framework/parsers.py\u003c/code\u003e before invoking the codec:\u003c/p\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre tabindex=\"0\" class=\"chroma\"\u003e\u003ccode class=\"language-python\" data-lang=\"python\"\u003e\u003cspan class=\"line\"\u003e\u003cspan class=\"cl\"\u003e\u003cspan class=\"kn\"\u003eimport\u003c/span\u003e \u003cspan class=\"nn\"\u003ecodecs\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan class=\"line\"\u003e\u003cspan class=\"cl\"\u003e\u003cspan class=\"kn\"\u003efrom\u003c/span\u003e \u003cspan class=\"nn\"\u003erest_framework.exceptions\u003c/span\u003e \u003cspan class=\"kn\"\u003eimport\u003c/span\u003e \u003cspan class=\"n\"\u003eParseError\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan class=\"line\"\u003e\u003cspan class=\"cl\"\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan class=\"line\"\u003e\u003cspan class=\"cl\"\u003e\u003cspan class=\"k\"\u003eif\u003c/span\u003e \u003cspan class=\"ow\"\u003enot\u003c/span\u003e \u003cspan class=\"n\"\u003ecodecs\u003c/span\u003e\u003cspan class=\"o\"\u003e.\u003c/span\u003e\u003cspan class=\"n\"\u003elookup\u003c/span\u003e\u003cspan class=\"p\"\u003e(\u003c/span\u003e\u003cspan class=\"n\"\u003eencoding\u003c/span\u003e\u003cspan class=\"p\"\u003e)\u003c/span\u003e\u003cspan class=\"o\"\u003e.\u003c/span\u003e\u003cspan class=\"n\"\u003e_is_text_encoding\u003c/span\u003e\u003cspan class=\"p\"\u003e:\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan class=\"line\"\u003e\u003cspan class=\"cl\"\u003e \u003cspan class=\"k\"\u003eraise\u003c/span\u003e \u003cspan class=\"n\"\u003eParseError\u003c/span\u003e\u003cspan class=\"p\"\u003e(\u003c/span\u003e\u003cspan class=\"s1\"\u003e\u0026#39;Unsupported charset in Content-Type\u0026#39;\u003c/span\u003e\u003cspan class=\"p\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003cp\u003eUntil patches are applied, monitor for unusual \u003ccode\u003eContent-Type\u003c/code\u003e headers containing non-standard charset parameters in application access logs.\u003c/p\u003e\n","date_modified":"2026-10-29T22:22:23Z","date_published":"2026-10-29T22:22:23Z","id":"https://feed.craftedsignal.io/briefs/2026-10-django-rest-framework-json-memory-exhaustion/","summary":"Django REST framework (DRF) JSONParser fails to validate charset codecs, allowing attackers to bypass DATA_UPLOAD_MAX_MEMORY_SIZE limits through malicious compression, leading to significant memory amplification.","title":"Django REST framework: JSONParser memory exhaustion via charset parameter","url":"https://feed.craftedsignal.io/briefs/2026-10-django-rest-framework-json-memory-exhaustion/"}],"language":"en","title":"CraftedSignal Threat Feed - Django REST Framework (\u003e= 3.6.4)","version":"https://jsonfeed.org/version/1.1"}