High Severity CVE-2026-114138 Allows Unauthenticated DoS in Django REST Framework
An unauthenticated denial-of-service flaw in Django REST Framework versions below 3.18.2 allows attackers to exhaust server resources using crafted HTTP headers.
Key points
- CVE-2026-114138 affects Django REST Framework versions prior to 3.18.2 and is rated high severity.
- The vulnerability requires no authentication and exploits quadratic parsing time in Django's header handling.
- A patched version, 3.18.2, is available to mitigate the resource exhaustion risk.
Django REST Framework environments running versions older than 3.18.2 are exposed to a high-severity denial-of-service vulnerability identified as CVE-2026-114138, according to GitHub advisory GHSA-33wh-fxxf-88vv. The flaw allows unauthenticated attackers to freeze application workers by sending specially crafted HTTP requests that exploit inefficient header parsing logic within the framework.
What is the technical root cause?
The vulnerability stems from how Django REST Framework handles content negotiation for incoming requests. The framework parses every Accept header token multiple times per request without imposing limits on token count or total size. Each parse triggers Django's parse_header_parameters function, which operates in quadratic time when processing quoted parameter values containing semicolons. This inefficiency turns simple header parsing into a computationally expensive task that consumes significant CPU cycles.
How severe is the operational impact?
Testing described in the advisory shows a single GET request with a 780KB Accept header containing 96 tokens kept one Gunicorn worker busy for nearly nineteen seconds. The header was syntactically valid and fit within default server limits. When two concurrent requests were sent to a default two-worker deployment, the entire service stopped responding for the duration of the test. The service recovered quickly after the attack traffic ceased, indicating the issue is resource exhaustion rather than persistent corruption.
Why does the parser run multiple times?
Django REST Framework re-runs content negotiation when no matching renderer is found. The framework raises a NotAcceptable error, which itself requires a renderer to format the response. This triggers a forced re-negotiation pass through the same parsing logic. With default configurations, this results in approximately six parse operations per Accept token per request, multiplying the computational cost of each malicious header significantly beyond a single pass.
What is the remediation path?
The Django REST Framework maintainers have released version 3.18.2 to address this vulnerability. Teams should update their dependencies to this patched version immediately to prevent resource exhaustion attacks. The fix resolves the unbounded parsing behavior that allowed attackers to leverage valid but expensive header structures to disrupt service availability. No other workarounds were specified in the advisory material.
Detection notes
Security operations teams should monitor for unusual spikes in CPU usage on application servers that do not correlate with increased request volume. Look for HTTP requests containing excessively large Accept headers or headers with complex quoted parameters. Check web server logs for requests that result in high latency or timeouts despite low traffic levels. If such patterns emerge, consider temporarily rate-limiting requests with large headers while investigating. Verify that your WAF rules are not bypassing these specific header structures. Ensure logging captures full header sizes to aid in forensic analysis of potential abuse.
What to do and how to stay safe: Django REST Framework
- Update Django REST Framework to version 3.18.2 or later to apply the vendor-provided fix.
- Review web server configurations to enforce stricter limits on HTTP header sizes where possible.
- Monitor application logs for requests with abnormally large Accept headers or high processing times.
- Implement rate limiting for endpoints that perform heavy content negotiation to reduce exposure.
Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them
General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Django REST Framework versions are vulnerable?
Versions prior to 3.18.2 are vulnerable to CVE-2026-114138.
Does the attack require authentication?
No, the advisory states the attack needs no authentication.
What is the CVSS severity rating?
The advisory rates the severity as high.
