CVE-2026-73228

Affected versions of the Django REST Framework (DRF) package are vulnerable to Improper Input Validation due to bypassing Django's `DATA_UPLOAD_MAX_MEMORY_SIZE` protection when parsing oversized JSON and urlencoded request bodies via `request.data`. The `request.data` method in DRF allows parsers to consume the request stream directly through Django's lower-level streaming interface, which does not trigger the `RequestDataTooBig` protection that is enforced when using `request.body` or Django's native `request.POST`. An attacker can exploit this vulnerability by sending oversized JSON or URL-encoded request bodies to DRF endpoints, potentially leading to increased memory allocation and CPU usage, thereby reducing the effectiveness of resource consumption limits in affected deployments.