Hi,

The following vulnerabilities were published for djangorestframework.

CVE-2026-73228[0]:
| Django REST framework is a toolkit for building Web APIs. Prior to
| 3.17.2, Django REST Framework's request.data parsing in
| rest_framework/request.py Request._parse() passes the underlying
| HttpRequest stream to JSONParser and FormParser for application/json
| and application/x-www-form-urlencoded bodies, bypassing Django's
| DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized
| request bodies to consume additional memory and CPU. This issue is
| fixed in version 3.17.2.


CVE-2026-73229[1]:
| Django REST framework is a powerful and flexible toolkit for
| building Web APIs. Prior to 3.17.2, Django REST Framework's
| rest_framework/renderers.py AdminRenderer.render() uses
| override_method() to simulate GET and directly invokes view.get()
| without view.check_permissions() while rendering an invalid write
| request, allowing a 400 Bad Request HTML response to disclose data
| from a GET representation that the requester is not permitted to
| access. This issue is fixed in version 3.17.2.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-73228
https://www.cve.org/CVERecord?id=CVE-2026-73228
[1] https://security-tracker.debian.org/tracker/CVE-2026-73229
https://www.cve.org/CVERecord?id=CVE-2026-73229

Regards,
Salvatore