CVE-2026-114136

Affected versions of the Django REST framework package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to `JSONParser.parse` decoding the request body using a client-supplied charset without verifying it names an actual text encoding. The `JSONParser.parse` method passes the `Content-Type` charset parameter directly to `codecs.getreader`, which, unlike other codec-resolution paths in Django, does not check `CodecInfo._is_text_encoding` and therefore accepts byte-transform codecs such as `bz2_codec` and `zlib_codec`; because Django's `DATA_UPLOAD_MAX_MEMORY_SIZE` check is enforced against the raw wire bytes before this decoding occurs, the subsequent decompression inside the parser happens after the size guard and is uncounted. An unauthenticated attacker can send a small request body (as little as 108 bytes) to any endpoint using DRF's default JSON parser with a `Content-Type: application/json; charset=bz2_codec` header, causing the server to decompress it into tens of megabytes of data in memory, achieving amplification ratios exceeding 400,000x and allowing a modest number of concurrent requests to exhaust worker memory and cause a Denial of Service.