Hi,

The following vulnerabilities were published for djangorestframework.

CVE-2026-73228[0]:
| Django REST framework is a toolkit for building Web APIs. Prior to
| 3.17.2, Django REST Framework's request.data parsing in
| rest_framework/request.py Request._parse() passes the underlying
| HttpRequest stream to JSONParser and FormParser for application/json
| and application/x-www-form-urlencoded bodies, bypassing Django's
| DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized
| request bodies to consume additional memory and CPU. This issue is
| fixed in version 3.17.2.


CVE-2026-73229[1]:
| Django REST framework is a powerful and flexible toolkit for
| building Web APIs. Prior to 3.17.2, Django REST Framework's
| rest_framework/renderers.py AdminRenderer.render() uses
| override_method() to simulate GET and directly invokes view.get()
| without view.check_permissions() while rendering an invalid write
| request, allowing a 400 Bad Request HTML response to disclose data
| from a GET representation that the requester is not permitted to
| access. This issue is fixed in version 3.17.2.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-73228
https://www.cve.org/CVERecord?id=CVE-2026-73228
[1] https://security-tracker.debian.org/tracker/CVE-2026-73229
https://www.cve.org/CVERecord?id=CVE-2026-73229

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
djangorestframework, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144350@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Colin Watson <cjwatson@debian.org> (supplier of updated djangorestframework package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 27 Sep 2026 13:51:51 +0100
Source: djangorestframework
Architecture: source
Version: 3.18.1+ds1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Colin Watson <cjwatson@debian.org>
Closes: 1144350
Changes:
 djangorestframework (3.18.1+ds1-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release (closes: #1144350):
     - CVE-2026-73228: Enforce `DATA_UPLOAD_MAX_MEMORY_SIZE` for
       `request.data` parsing.
     - CVE-2026-73229: Fix disclosure of GET-protected data in case of
       validation error with `AdminRenderer`.
   * Drop python3-pytz dependency, no longer present upstream.
   * Patch out uses of Google Fonts, avoiding privacy breaches.
Checksums-Sha1:
 fcc16bec63f475b242cc2d38e6a4e8f536ccc945 3389 djangorestframework_3.18.1+ds1-1.dsc
 9a34553554e3fc742f3e52ac5c3b40d619fa241a 10459467 djangorestframework_3.18.1+ds1.orig.tar.gz
 5302f25bad49f69204dc45389e51f4a992d7f145 298888 djangorestframework_3.18.1+ds1-1.debian.tar.xz
 33939e985c107ba65f6bc9110ad5465f8714676a 11829188 djangorestframework_3.18.1+ds1-1.git.tar.xz
 e05ddf7262bd001f52cbd0efc86959a911ca0344 17792 djangorestframework_3.18.1+ds1-1_source.buildinfo
Checksums-Sha256:
 86bd7c9236658968a4679134e964df2f8b222f9a3818e75cc1b565f1d075ca20 3389 djangorestframework_3.18.1+ds1-1.dsc
 b466babc4540204709ec20b23214d0f8e1cba061d46b07b884034fb13d8bfb63 10459467 djangorestframework_3.18.1+ds1.orig.tar.gz
 cc8292f1f7b7e83a9876996b91d431da99a071449eb54a13f0582641f92a801f 298888 djangorestframework_3.18.1+ds1-1.debian.tar.xz
 7bfa9fda0d44eb8e12f64de9aecf2c539028cbaf4b64bf2d36be6569f3faf209 11829188 djangorestframework_3.18.1+ds1-1.git.tar.xz
 3ac6e4eee2cc512add0032a6bd085ba10f14fa6e9519e13d3a4513d827d5aa1a 17792 djangorestframework_3.18.1+ds1-1_source.buildinfo
Files:
 ac50e5b12b8b419b7527a63560dbcfaf 3389 python optional djangorestframework_3.18.1+ds1-1.dsc
 65c4bdb96cde2e3dc5be0c01083be7dd 10459467 python optional djangorestframework_3.18.1+ds1.orig.tar.gz
 49f40248039680eeada6b481c9614a42 298888 python optional djangorestframework_3.18.1+ds1-1.debian.tar.xz
 d9feef7fd55fb87ffe8c478dfd5e44e2 11829188 python optional djangorestframework_3.18.1+ds1-1.git.tar.xz
 631313383d44754e5843f50e8680b6bd 17792 python optional djangorestframework_3.18.1+ds1-1_source.buildinfo
Git-Tag-Info: tag=f0442c54c110bc8f8eebd8e71262bfa57a01957d fp=ac0a4ff12611b6fccf01c111393587d97d86500b
Git-Tag-Tagger: Colin Watson <cjwatson@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmq5EgUACgkQYG0ITkaD
wHma2xAAnLRA13tE+YI9s9vurXr62UGdqrCUbXlrgeDpxTZOntMGhb/i+kCFSwpe
sUOO5zQQ/xv8/a5LOPx7T5aAIWP/qHuvqFMGL/VosVFFjz8KyvSfvZuPWH0hEMm4
NT9l/eatKf5yVqWiOJcwebNA0lNZ1hF/3bR3o6o1yV6n0l5YtjPqCEUearxE0uRH
IAbJ1LwGZ333oc3Q5o5QZbYoZtn2R1NazkKfCTTzsuPga60kpt0Uy9CLY+TnbVZp
26uBzu+1q3HQJU+JC27yTtfnxawnQpxN/oajFqXj0hhCbgednB5qB3wG1zmjWvgz
ViRbF29LwLtpMPEGQ8G0yUL1cEwV9Nbgz3wVcDL/PmmDwKzmwAxolW125mtz6PwG
AHqlF33kFdZVp+SVTJj/56KxCfPJ+W/UaW9MYsJAf03/4+oUiX1dWL5b8dW3Avsu
IPR4SfNpTSy93bnUYtGQjkWVZYAdqTz40URxezAPlScHHxiBBTPsE09BAsufw9ur
yRfzVjWLb+UpwPwYG2D5+pBZ/MlVNv2RMbTPJT5kOmdz7ZgMGF8/A9CpXsECe1sR
agNm7JMyjdMDKQbZ1lY421CSsg5fCvcjX9+G6SGZXNEE+yS+dQD/2Afsn7Rs18eg
jgkP+D728dCeIkwQmjIKVBkdZ8xlPrlmy7/SpJPSmMmtS0hLxxU=
=tNga
-----END PGP SIGNATURE-----