Encode
Monthly
Denial of service in Django REST Framework prior to 3.18.2 allows a remote unauthenticated client to pin synchronous workers for prolonged periods by sending Accept headers packed with a large number of media-type tokens carrying oversized quoted parameter values and many semicolons; the Content-Type header is a secondary, now length-capped, vector. Impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/A:H, 7.5) and self-healing once requests stop, but on WSGI/sync worker deployments (e.g. gunicorn sync workers) concurrent requests can exhaust the worker pool and take the service offline. No public exploit code and no active exploitation are indicated in the supplied intelligence, and no EPSS score was provided, so this reads as a genuine but bounded availability risk rather than an emergency.
Failed token revocation in Django REST Framework 3.12.0 through 3.18.1 leaves API credentials live after they are supposedly revoked: calling delete() on a TokenProxy instance issues a DELETE that matches no row, returns a zero count, and raises no error, so applications, admin integrations, or operational scripts that trust the return value believe the credential is gone while it continues to authenticate requests. The defect is a credential-hygiene and failed-revocation problem (CWE-390) rather than a directly exploitable remote flaw - the CVSS 3.1 base score is 7.4 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, and because DRF tokens never expire automatically, any token that escapes revocation stays valid indefinitely until the database row is cleaned up manually. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the practical prerequisite is that an attacker already holds a previously issued token that the victim attempted to revoke through the affected code path.
Memory exhaustion in Django REST framework 3.6.4 through 3.18.1 lets a remote unauthenticated client make a single small JSON request balloon into a much larger in-memory body, degrading or crashing the worker that handles it. Because the affected JSONParser ships in the default parser set, any reachable DRF endpoint that accepts a JSON body is a candidate target - the attacker simply names a byte-transform codec such as bz2_codec in the request's Content-Type charset and sends a correspondingly compressed payload. Impact is limited to availability (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) rather than confidentiality or integrity; no public exploit code was identified at time of analysis and there is no CISA KEV entry, so this is a genuine but bounded denial-of-service risk pending upgrade to 3.18.2.
Host header injection in Starlette prior to version 1.0.1 allows unauthenticated remote attackers to cause `request.url.path` to differ from the actual ASGI scope path used for routing, enabling bypass of middleware and endpoint security controls that rely on `request.url` rather than the raw scope. Any application enforcing path-based ACLs, authentication gates, or WAF-style filters through `request.url` is affected, as a crafted Host header can make the URL appear to address a permitted path while the real route differs. This issue carries CVSS 6.5 (AV:N/AC:L/PR:N/UI:N); no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Uncontrolled resource consumption in Django REST Framework prior to 3.17.2 allows unauthenticated remote attackers to exhaust server memory and CPU by sending arbitrarily large request bodies via application/json or application/x-www-form-urlencoded content types. The framework's Request._parse() method passes the raw HttpRequest stream directly to JSONParser and FormParser, silently bypassing Django's built-in DATA_UPLOAD_MAX_MEMORY_SIZE guard. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the attack requires no authentication and no special configuration, making any exposed DRF API endpoint a viable target.
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
This affects all versions of package uvicorn. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Denial of service in Django REST Framework prior to 3.18.2 allows a remote unauthenticated client to pin synchronous workers for prolonged periods by sending Accept headers packed with a large number of media-type tokens carrying oversized quoted parameter values and many semicolons; the Content-Type header is a secondary, now length-capped, vector. Impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/A:H, 7.5) and self-healing once requests stop, but on WSGI/sync worker deployments (e.g. gunicorn sync workers) concurrent requests can exhaust the worker pool and take the service offline. No public exploit code and no active exploitation are indicated in the supplied intelligence, and no EPSS score was provided, so this reads as a genuine but bounded availability risk rather than an emergency.
Failed token revocation in Django REST Framework 3.12.0 through 3.18.1 leaves API credentials live after they are supposedly revoked: calling delete() on a TokenProxy instance issues a DELETE that matches no row, returns a zero count, and raises no error, so applications, admin integrations, or operational scripts that trust the return value believe the credential is gone while it continues to authenticate requests. The defect is a credential-hygiene and failed-revocation problem (CWE-390) rather than a directly exploitable remote flaw - the CVSS 3.1 base score is 7.4 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, and because DRF tokens never expire automatically, any token that escapes revocation stays valid indefinitely until the database row is cleaned up manually. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the practical prerequisite is that an attacker already holds a previously issued token that the victim attempted to revoke through the affected code path.
Memory exhaustion in Django REST framework 3.6.4 through 3.18.1 lets a remote unauthenticated client make a single small JSON request balloon into a much larger in-memory body, degrading or crashing the worker that handles it. Because the affected JSONParser ships in the default parser set, any reachable DRF endpoint that accepts a JSON body is a candidate target - the attacker simply names a byte-transform codec such as bz2_codec in the request's Content-Type charset and sends a correspondingly compressed payload. Impact is limited to availability (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) rather than confidentiality or integrity; no public exploit code was identified at time of analysis and there is no CISA KEV entry, so this is a genuine but bounded denial-of-service risk pending upgrade to 3.18.2.
Host header injection in Starlette prior to version 1.0.1 allows unauthenticated remote attackers to cause `request.url.path` to differ from the actual ASGI scope path used for routing, enabling bypass of middleware and endpoint security controls that rely on `request.url` rather than the raw scope. Any application enforcing path-based ACLs, authentication gates, or WAF-style filters through `request.url` is affected, as a crafted Host header can make the URL appear to address a permitted path while the real route differs. This issue carries CVSS 6.5 (AV:N/AC:L/PR:N/UI:N); no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Uncontrolled resource consumption in Django REST Framework prior to 3.17.2 allows unauthenticated remote attackers to exhaust server memory and CPU by sending arbitrarily large request bodies via application/json or application/x-www-form-urlencoded content types. The framework's Request._parse() method passes the raw HttpRequest stream directly to JSONParser and FormParser, silently bypassing Django's built-in DATA_UPLOAD_MAX_MEMORY_SIZE guard. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the attack requires no authentication and no special configuration, making any exposed DRF API endpoint a viable target.
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
This affects all versions of package uvicorn. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.