djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (CVE-2026-114136)

Overview

A flaw was found in Django REST framework. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by exhausting server memory. The issue occurs because the JSON parser accepts arbitrary client-supplied charset encodings, including decompression codecs, rather than restricting input to text encodings. By sending a crafted, compressed request, an attacker can bypass request size limits and trigger excessive memory allocation during parsing.

Vendor advisories

• Red Hat VEX · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat Discovery 2, Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Discovery 2, Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers · updated 2026-10-23 · vex

djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser — rated Important by Red Hat. Released 2026-10-21, updated 2026-10-23.

Affected:

• Red Hat Ansible Automation Platform 2
• Red Hat Discovery 2
• Red Hat Satellite 6
• Red Hat Update Infrastructure 4 for Cloud Providers

No fix planned:

• Red Hat Ansible Automation Platform 2
• Red Hat Discovery 2
• Red Hat Satellite 6
• Red Hat Update Infrastructure 4 for Cloud Providers

Not affected:

• Red Hat Ansible Automation Platform 2

Remediation

Affected

Package advisory (CVE-2026-114136)

Affected packages:

• djangorestframework >= 3.6.4, < 3.18.2

Patched in:

• djangorestframework 3.18.2

Source: https://osv.dev/vulnerability/GHSA-3547-9m27-7rxg