Django REST Framework (>= 3.6.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/django-rest-framework--3.6.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 22:22:23 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDjango REST framework: JSONParser memory exhaustion via charset parameterhttps://feed.craftedsignal.io/briefs/2026-10-django-rest-framework-json-memory-exhaustion/Thu, 29 Oct 2026 22:22:23 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-django-rest-framework-json-memory-exhaustion/Django REST framework (DRF) JSONParser fails to validate charset codecs, allowing attackers to bypass DATA_UPLOAD_MAX_MEMORY_SIZE limits through malicious compression, leading to significant memory amplification.Django REST framework (DRF) versions 3.6.4 and later contain a vulnerability in JSONParser where the Content-Type charset parameter is used to apply arbitrary codecs to the request stream. Because DRF does not verify if the requested charset is a valid text encoding, an attacker can specify byte-transform codecs like bz2_codec or zlib_codec. This results in the request body being decompressed into memory before the DATA_UPLOAD_MAX_MEMORY_SIZE check is performed, allowing for massive memory expansion.

Attack Chain

  1. Attacker crafts a highly compressed malicious JSON payload (e.g., 108 bytes).
  2. Attacker initiates a POST request to a DRF endpoint accepting JSON.
  3. Attacker sets the Content-Type header to application/json; charset=bz2_codec.
  4. Django receives the request and initializes JSONParser.
  5. JSONParser calls codecs.getreader() with the attacker-provided bz2_codec.
  6. The request stream is decompressed into memory by the codec reader.
  7. The expanded data is passed to json.load() while the original DATA_UPLOAD_MAX_MEMORY_SIZE check remains satisfied by the small wire-size of the payload.
  8. The worker process consumes significant memory, potentially causing a Denial of Service (DoS).

Impact

The vulnerability allows an amplification factor of over 400,000x, where a 108-byte request can force the allocation of ~50 MiB of memory, significantly increasing process peak RSS and facilitating memory-based DoS.

Recommendation

Patch the JSONParser to validate that the provided encoding is a supported text-based encoding. Implement the following check within rest_framework/parsers.py before invoking the codec:

import codecs
from rest_framework.exceptions import ParseError

if not codecs.lookup(encoding)._is_text_encoding:
 raise ParseError('Unsupported charset in Content-Type')

Until patches are applied, monitor for unusual Content-Type headers containing non-standard charset parameters in application access logs.

]]>highadvisory