Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

djangorestframework

7 known vulnerabilities (3 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
3.18.3 (Oct 6, 2026): no advisory affects it
Newest unaffected release
3.18.3 (Oct 6, 2026), the latest release
Advisories
7 · 3 high, 3 medium
Weekly downloads
6.9M
Dependents
3,187
Releases
145 since 0.1.0 (Feb 21, 2011)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

  • Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

    Affected: fixed in 3.18.2.

    Fixed in 3.18.2 (released Oct 6, 2026, 15 days before disclosure).

    The latest release, 3.18.3, is not affected.

  • Django REST framework: TokenProxy.delete() reports success and revokes nothing

    Affected: from 3.12.0, fixed in 3.18.2.

    Fixed in 3.18.2 (released Oct 6, 2026, 15 days before disclosure).

    The latest release, 3.18.3, is not affected.

  • Django REST framework: JSONParser applies an attacker-named codec to the request stream

    Affected: from 3.6.4, fixed in 3.18.2.

    Fixed in 3.18.2 (released Oct 6, 2026, 15 days before disclosure).

    The latest release, 3.18.3, is not affected.

  • CVE-2026-73229Medium 4.3

    Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

    Affected: fixed in 3.17.2.

    Fixed in 3.17.2 (released Aug 5, 2026, 6 days before disclosure).

    The latest release, 3.18.3, is not affected.

  • CVE-2026-73228Medium 5.3

    Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies…

    Affected: fixed in 3.17.2.

    Fixed in 3.17.2 (released Aug 5, 2026, 6 days before disclosure).

    The latest release, 3.18.3, is not affected.

  • CVE-2024-21520Medium 5.3

    Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template…

    Affected: fixed in 3.15.2.

    Fixed in 3.15.2 (released Jun 19, 2024, 7 days before disclosure).

    The latest release, 3.18.3, is not affected.

  • A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2.

    Affected: fixed in 3.11.2.

    Fixed in 3.11.2 (released Sep 30, 2020, the day of disclosure).

    The latest release, 3.18.3, is not affected.