Source: djangorestframework Version: 3.17.1+ds1-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for djangorestframework. CVE-2026-73228[0]: | Django REST framework is a toolkit for building Web APIs. Prior to | 3.17.2, Django REST Framework's request.data parsing in | rest_framework/request.py Request._parse() passes the underlying | HttpRequest stream to JSONParser and FormParser for application/json | and application/x-www-form-urlencoded bodies, bypassing Django's | DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized | request bodies to consume additional memory and CPU. This issue is | fixed in version 3.17.2. CVE-2026-73229[1]: | Django REST framework is a powerful and flexible toolkit for | building Web APIs. Prior to 3.17.2, Django REST Framework's | rest_framework/renderers.py AdminRenderer.render() uses | override_method() to simulate GET and directly invokes view.get() | without view.check_permissions() while rendering an invalid write | request, allowing a 400 Bad Request HTML response to disclose data | from a GET representation that the requester is not permitted to | access. This issue is fixed in version 3.17.2. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-73228 https://www.cve.org/CVERecord?id=CVE-2026-73228 [1] https://security-tracker.debian.org/tracker/CVE-2026-73229 https://www.cve.org/CVERecord?id=CVE-2026-73229 Regards, Salvatore
