Django REST Framework

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain st…CVE-2020-25626Encode · 1.3% likely

   CWE-77

2. Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiationCVE-2026-114138encode · CVSS 7.5 · 0.6% likely

   CWE-407

3. Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`CVE-2026-73228encode · CVSS 5.3 · 0.6% likely

   CWE-770

4. Django REST framework: TokenProxy.delete() reports success and revokes nothingCVE-2026-114137encode · CVSS 7.4 · 0.5% likely

   CWE-390

5. Django REST framework: JSONParser applies an attacker-named codec to the request streamCVE-2026-114136encode · CVSS 7.5 · 0.5% likely

   CWE-409

6. Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requestsCVE-2026-73229encode · CVSS 4.3 · 0.4% likely

   CWE-200

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.