{"action":"Upgrade djangorestframework to 3.18.2 or later.","affected":[{"fixed":"3.18.2","introduced":"0"}],"component":"djangorestframework","cve_ids":["CVE-2026-114138"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["3.18.2"],"ghsa_id":"GHSA-33wh-fxxf-88vv","id":"tcs_01M5JMCRDA5C17CW469WHD7F1T","modified_at":"2026-10-22T16:30:29.911203144Z","published_at":"2026-10-22T16:17:13Z","references":["https://osv.dev/vulnerability/GHSA-33wh-fxxf-88vv","https://github.com/encode/django-rest-framework/security/advisories/GHSA-33wh-fxxf-88vv","https://nvd.nist.gov/vuln/detail/CVE-2026-114138","https://github.com/encode/django-rest-framework/commit/148ab6523922d5a0c110f76615935e5220b63029","https://github.com/encode/django-rest-framework","https://github.com/encode/django-rest-framework/releases/tag/3.18.2"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-33wh-fxxf-88vv","url":"https://osv.dev/vulnerability/GHSA-33wh-fxxf-88vv"}],"summary":"Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation"}