PyPI/djangorestframework CVE-2026-73229: medium 4.3, EPSS 0.37%

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Action: Upgrade djangorestframework to 3.17.2 or later.

pip install djangorestframework==3.17.2

Affected

Fixed versions

Sources

• osv: PYSEC-2026-3828
• https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2
• https://nvd.nist.gov/vuln/detail/CVE-2026-73229
• https://github.com/encode/django-rest-framework/pull/10012
• https://github.com/encode/django-rest-framework/commit/71f81946906e52f9dc8e5d22a0f3d2afa50c455e
• https://github.com/encode/django-rest-framework/commit/9e82afc98acfe6fc28c9bf78147f0c5b3f222cb5
• https://github.com/encode/django-rest-framework
• https://github.com/encode/django-rest-framework/releases/tag/3.17.2
• https://pypi.org/project/djangorestframework
• https://github.com/advisories/GHSA-g47c-3xmw-q6m2

CVE-2026-73229 · published 2026-09-10T09:44:58.942329Z · modified 2026-09-10T12:15:04.001259003Z · JSON