djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing (CVE-2026-114138)

Overview

A flaw was found in djangorestframework. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending HTTP requests with a specially crafted Accept header containing an excessive number of media types with complex parameters. Because the framework performs unbounded and repetitive parsing of these header tokens across available renderers, processing such requests consumes disproportionate CPU resources. This can exhaust application worker processes and render the API service unavailable to legitimate users.

Vendor advisories

• Red Hat VEX · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat Discovery 2, Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Discovery 2, Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers · updated 2026-10-23 · vex

djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing — rated Important by Red Hat. Released 2026-10-21, updated 2026-10-23.

Affected:

• Red Hat Ansible Automation Platform 2
• Red Hat Discovery 2
• Red Hat Satellite 6
• Red Hat Update Infrastructure 4 for Cloud Providers

No fix planned:

• Red Hat Ansible Automation Platform 2
• Red Hat Discovery 2
• Red Hat Satellite 6
• Red Hat Update Infrastructure 4 for Cloud Providers

Not affected:

• Red Hat Ansible Automation Platform 2

Remediation

Affected

Package advisory (CVE-2026-114138)

Affected packages:

• djangorestframework < 3.18.2

Patched in:

• djangorestframework 3.18.2

Source: https://osv.dev/vulnerability/GHSA-33wh-fxxf-88vv