Threats affecting pkg:pypi/django-rest-framework

Django REST framework versions prior to 3.18.2 have an uncontrolled resource consumption vulnerability in the DefaultContentNegotiation.get_accept_list method. An unauthenticated attacker can exploit this by sending requests with many distinct media types containing large quoted parameter values, causing excessive CPU usage and denial of service. The issue is fixed in version 3.18.2.

A vulnerability in django-rest-framework versions 3.12.0 through 3.18.1 causes TokenProxy.delete() to fail silently when attempting to revoke tokens. This occurs because the deletion query uses the proxy's user-id primary key instead of the token-string primary key, resulting in zero deletions without error. Consequently, tokens may remain active and continue authenticating despite apparent revocation. The issue is fixed in version 3.18.2.

A vulnerability in Django REST framework versions from 3.6.4 up to but not including 3.18.2 allows remote unauthenticated clients to send highly compressed JSON request bodies that expand significantly in memory after initial size checks. This improper handling of compressed data can cause excessive memory consumption per worker, potentially leading to denial of service. The issue is fixed in version 3.18.2.

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2.

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.