{"id":"CVE-2026-114138","title":"djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing (CVE-2026-114138)","summary":"A flaw was found in djangorestframework. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending HTTP requests with a specially crafted Accept header containing an excessive number of media types with complex para…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-770","CWE-400","CWE-407"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","affected":["ansible_automation_platform 2","discovery 2","satellite 6","update_infrastructure_4_for_cloud_providers"],"patched":["djangorestframework 3.18.2"],"published":"2026-10-21","updated":"2026-10-23","sourceUpdated":"2026-10-23T10:43:23+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114138.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114138.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-114138"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558553"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114138"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114138"},{"url":"https://github.com/encode/django-rest-framework/commit/148ab6523922d5a0c110f76615935e5220b63029"},{"url":"https://github.com/encode/django-rest-framework/releases/tag/3.18.2"},{"url":"https://github.com/encode/django-rest-framework/security/advisories/GHSA-33wh-fxxf-88vv"},{"url":"https://github.com/encode/django-rest-framework"},{"url":"https://github.com/advisories/GHSA-33wh-fxxf-88vv"}],"tags":["csaf","vex","red-hat","osv","pip","ghsa","cve.org"],"epss":0.0052,"epssPercentile":0.44005,"aliases":["GHSA-33wh-fxxf-88vv"],"ecosystem":"pip","ingestedAt":"2026-10-21T21:13:32.895Z","slug":"CVE-2026-114138","body":"## Overview\n\nA flaw was found in djangorestframework. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending HTTP requests with a specially crafted Accept header containing an excessive number of media types with complex parameters. Because the framework performs unbounded and repetitive parsing of these header tokens across available renderers, processing such requests consumes disproportionate CPU resources. This can exhaust application worker processes and render the API service unavailable to legitimate users.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat Discovery 2, Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Discovery 2, Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114138.json)\n\n**djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing** — rated Important by Red Hat. Released 2026-10-21, updated 2026-10-23.\n\nAffected:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat Discovery 2\n- Red Hat Satellite 6\n- Red Hat Update Infrastructure 4 for Cloud Providers\n\nNo fix planned:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat Discovery 2\n- Red Hat Satellite 6\n- Red Hat Update Infrastructure 4 for Cloud Providers\n\nNot affected:\n\n- Red Hat Ansible Automation Platform 2\n\n## Remediation\n\nAffected\n\n## Package advisory (CVE-2026-114138)\n\nAffected packages:\n\n- `djangorestframework < 3.18.2`\n\nPatched in:\n\n- `djangorestframework 3.18.2`\n\nSource: https://osv.dev/vulnerability/GHSA-33wh-fxxf-88vv","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}