Detections
Analytics

SCA: security update for djangorestframework (GHSA-33wh-fxxf-88vv)

high Tenable Cloud Security Plugin ID 476830

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2,
 DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and
 aggregate size of Accept tokens, while select_renderer in that file repeatedly invokes _MediaType parsing
 from rest_framework/utils/mediatypes.py for each attacker-controlled token, every renderer, and forced 406
 renegotiation. A remote unauthenticated client can send many distinct media types containing large quoted
 parameter values with numerous semicolons, causing Django's parameter parser and DRF's repeated parsing
 structure to consume disproportionate CPU. Requests to any reachable endpoint can pin synchronous workers
 for prolonged periods, and concurrent requests can make the service unavailable until the requests stop.
 This issue is fixed in version 3.18.2. (CVE-2026-114138)

Solution

Update the djangorestframework library and its related packages to version 3.18.2 or later.

See Also

https://github.com/advisories/GHSA-33wh-fxxf-88vv

Plugin Details

Severity: High

ID: 476830

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/22/2026

Updated: 10/22/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.74

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-114138

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/22/2026

Vulnerability Publication Date: 10/21/2026

Reference Information

CVE: CVE-2026-114138