CVE-2026-114136: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) in encode django-rest-framework

Django REST framework's JSONParser.parse method used the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec instead of restricting to text encodings. This allowed a remote unauthenticated attacker to send a compressed JSON request body that, although small on the wire and passing the DATA_UPLOAD_MAX_MEMORY_SIZE check, would decompress to a much larger size in memory. This data amplification can cause substantial per-worker memory consumption, affecting any endpoint accepting JSON bodies with the default parser. The vulnerability affects versions >=3.6.4 and <3.18.2 and was fixed in version 3.18.2.

An unauthenticated remote attacker can cause a denial of service by sending a small compressed JSON request that expands in memory, consuming excessive resources on the server. This can degrade service availability or crash workers due to memory exhaustion. There is no impact on confidentiality or integrity reported.

Upgrade django-rest-framework to version 3.18.2 or later, where this issue is fixed. No other mitigations are indicated or required.