encode/django-rest-framework Security Advisories | GitStock

high2026-10-22

Django REST framework: TokenProxy.delete() reports success and revokes nothing

GHSA-xw6w-gcfp-cf8m · CVE-2026-114137

high2026-10-22

Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

GHSA-33wh-fxxf-88vv · CVE-2026-114138

high2026-10-22

Django REST framework: JSONParser applies an attacker-named codec to the request stream

GHSA-3547-9m27-7rxg · CVE-2026-114136

medium2026-09-01

Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

GHSA-2m8g-3cmr-wg3w · CVE-2026-73228

medium2026-09-01

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

GHSA-g47c-3xmw-q6m2 · CVE-2026-73229

low2024-06-26

Cross-site Scripting in djangorestframework

GHSA-gw84-84pc-xp82 · CVE-2024-21520

medium2022-07-24

Django REST framework XSS Vulnerability

GHSA-xqcf-hj92-967m · CVE-2018-25045