THREATOPS
THREAT OPSThreat News › [GHSA] GHSA-2m8g-3cmr-wg3w (medium) — Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

[GHSA] GHSA-2m8g-3cmr-wg3w (medium) — Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

medgithub_advisoriesPublished 2026-09-01

GHSA-2m8g-3cmr-wg3w Severity: medium CVE: CVE-2026-73228

Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

## Summary

While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level `request.data` parsing appears to bypass Django's configured `D

Indicators of compromise

Original source: https://github.com/advisories/GHSA-2m8g-3cmr-wg3w