CVE-2026-114138

Affected versions of the djangorestframework package are vulnerable to Inefficient Algorithmic Complexity due to unbounded parsing of Accept header tokens during content negotiation. The `get_accept_list` function in `rest_framework/negotiation.py` splits the Accept header on commas without limiting the number of tokens or their size, and `select_renderer` calls `media_type_matches` for each renderer, which constructs new `_MediaType` objects via `django.utils.http.parse_header_parameters` for every token, a function that performs quadratic-time quote scanning on semicolon-packed quoted values; because DRF also re-runs this entire negotiation process a second time when raising a `NotAcceptable` 406 response through `finalize_response`, the cost multiplies further. An unauthenticated attacker can send a single HTTP GET request with multiple large Accept header fields, each containing a quoted parameter value packed with thousands of semicolons, to consume up to ~19 seconds of CPU time per request, and by issuing just two such concurrent requests against a default two-worker gunicorn deployment, can exhaust all available sync workers and render the service completely unresponsive to legitimate traffic for the duration of the attack.