Django REST Framework EUVD-2026-56887

No special conditions or non-default configuration are required beyond a network-accessible DRF endpoint that accepts POST requests with application/json or application/x-www-form-urlencoded content types - both of which are DRF defaults. Exploitation is fully unauthenticated (CVSS PR:N). Limiting factors include: any upstream reverse proxy or WAF that enforces a global request body size limit would constrain (but not fully prevent) impact; Django's DATA_UPLOAD_MAX_MEMORY_SIZE setting only helps once the patch is applied, as the pre-patch code bypasses it; and the impact is limited to availability (no confidentiality or integrity impact per CVSS C:N/I:N). MultiPartParser-based endpoints and endpoints using custom parsers are NOT affected by this specific bypass.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) accurately characterizes this as a low-complexity, network-reachable, unauthenticated availability issue. The low Availability impact score reflects partial, non-persistent disruption rather than full service crash. No EPSS data was provided in the intelligence, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed mass or targeted exploitation. The absence of a POC in the provided data further reduces near-term risk. However, the attack surface is broad: any DRF endpoint accepting JSON or URL-encoded POST bodies is vulnerable by default, without any special configuration required. Real-world impact depends on server resource limits, request rate, and whether upstream infrastructure (WAFs, reverse proxies, or load balancers) enforces body-size limits independently. SSVC signals point to a Defer/Scheduled patch posture for most operators: exploitation is not confirmed, technical impact is limited to availability, and the fix is straightforward with no breaking changes per the PR diff.

An unauthenticated attacker identifies a DRF-backed API endpoint that accepts POST requests with application/json or application/x-www-form-urlencoded content types. The attacker sends a continuous stream of requests each carrying a maximally large request body, causing the DRF Request._parse() method to allocate unbounded memory for each request before Django's size guard can intervene. Sustained flooding of this nature degrades or exhausts available server memory and CPU, resulting in service unavailability for legitimate users. No public exploit code has been identified at time of analysis.