{"action":"Upgrade djangorestframework to 3.17.2 or later.","affected":[{"fixed":"3.17.2","introduced":"0"}],"component":"djangorestframework","cve_ids":["CVE-2026-73228"],"ecosystem":"PyPI","epss":0.00557,"exploited":false,"fixed_versions":["3.17.2"],"ghsa_id":"GHSA-2m8g-3cmr-wg3w","id":"tcs_01M5KESTWFG2CP7W77H3P8VTHT","modified_at":"2026-09-10T12:25:57.397690757Z","published_at":"2026-09-01T19:24:51Z","references":["https://osv.dev/vulnerability/GHSA-2m8g-3cmr-wg3w","https://github.com/encode/django-rest-framework/security/advisories/GHSA-2m8g-3cmr-wg3w","https://nvd.nist.gov/vuln/detail/CVE-2026-73228","https://github.com/encode/django-rest-framework/pull/10013","https://github.com/encode/django-rest-framework/commit/2912dc98042f78e27636551fc22eeaf10f725fdd","https://github.com/encode/django-rest-framework/commit/82ef7b7e4e0a73ba5c489b465fae7e76d948da4e","https://github.com/encode/django-rest-framework","https://github.com/encode/django-rest-framework/releases/tag/3.17.2"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-2m8g-3cmr-wg3w","url":"https://osv.dev/vulnerability/GHSA-2m8g-3cmr-wg3w"}],"summary":"Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`"}