---
id: CVE-2026-114136
title: >-
  djangorestframework: djangorestframework: Denial of Service via improper
  charset handling in JSON parser (CVE-2026-114136)
summary: >-
  A flaw was found in Django REST framework. This vulnerability allows a remote,
  unauthenticated attacker to cause a Denial of Service (DoS) by exhausting
  server memory. The issue occurs because the JSON parser accepts arbitrary
  client-suppl…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-409
  - CWE-770
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
affected:
  - ansible_automation_platform 2
  - discovery 2
  - satellite 6
  - update_infrastructure_4_for_cloud_providers
patched:
  - djangorestframework 3.18.2
published: '2026-10-21'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T10:43:04+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114136.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114136.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-114136'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2558525'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-114136'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-114136'
  - url: >-
      https://github.com/encode/django-rest-framework/commit/3c2634599b26a9f789b03045118dbc276117611a
  - url: 'https://github.com/encode/django-rest-framework/releases/tag/3.18.2'
  - url: >-
      https://github.com/encode/django-rest-framework/security/advisories/GHSA-3547-9m27-7rxg
  - url: 'https://github.com/encode/django-rest-framework'
  - url: 'https://github.com/advisories/GHSA-3547-9m27-7rxg'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
  - ghsa
  - cve.org
epss: 0.0044
epssPercentile: 0.38075
aliases:
  - GHSA-3547-9m27-7rxg
ecosystem: pip
ingestedAt: '2026-10-21T20:11:44.901Z'
---

## Overview

A flaw was found in Django REST framework. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by exhausting server memory. The issue occurs because the JSON parser accepts arbitrary client-supplied charset encodings, including decompression codecs, rather than restricting input to text encodings. By sending a crafted, compressed request, an attacker can bypass request size limits and trigger excessive memory allocation during parsing.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat Discovery 2, Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Discovery 2, Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114136.json)

**djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser** — rated Important by Red Hat. Released 2026-10-21, updated 2026-10-23.

Affected:

- Red Hat Ansible Automation Platform 2
- Red Hat Discovery 2
- Red Hat Satellite 6
- Red Hat Update Infrastructure 4 for Cloud Providers

No fix planned:

- Red Hat Ansible Automation Platform 2
- Red Hat Discovery 2
- Red Hat Satellite 6
- Red Hat Update Infrastructure 4 for Cloud Providers

Not affected:

- Red Hat Ansible Automation Platform 2

## Remediation

Affected

## Package advisory (CVE-2026-114136)

Affected packages:

- `djangorestframework >= 3.6.4, < 3.18.2`

Patched in:

- `djangorestframework 3.18.2`

Source: https://osv.dev/vulnerability/GHSA-3547-9m27-7rxg