CVE-2026-114138High 7.5Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation0.6%
CVE-2026-114137High 7.4Django REST framework: TokenProxy.delete() reports success and revokes nothing0.5%
CVE-2026-114136High 7.5Django REST framework: JSONParser applies an attacker-named codec to the request stream0.5%
CVE-2026-73229Medium 4.3Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests0.4%
CVE-2026-73228Medium 5.3Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`0.6%