Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-73228, describes a bypass of Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection in Django REST Framework when parsing oversized JSON and urlencoded request bodies. The vulnerability specifically points to rest_framework/request.py Request._parse() as the location where the underlying HttpRequest stream is passed to JSONParser and FormParser.
Upon analyzing the provided commit 2912dc98042f78e27636551fc22eeaf10f725fdd, the patch clearly modifies the _parse method within the Request class in rest_framework/request.py. The key change is the introduction of a conditional block:
from rest_framework.parsers import FormParser, JSONParser
if isinstance(parser, (JSONParser, FormParser)):
stream = io.BytesIO(self.body)
Before this patch, the stream variable passed to parser.parse would have been the raw HttpRequest stream, which does not respect DATA_UPLOAD_MAX_MEMORY_SIZE. By explicitly checking if the parser is JSONParser or FormParser and then creating the stream from self.body (which is already limited by Django's DATA_UPLOAD_MAX_MEMORY_SIZE), the patch effectively closes the bypass. Therefore, the Request._parse method is the function that contained the vulnerability, as it was responsible for handling the parsing logic that allowed the oversized bodies to be processed without proper size checks.
Request._parserest_framework/request.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| djangorestframework | pip | < 3.17.2 | 3.17.2 |