Detections
Analytics
FreeBSD : py-djangorestframework -- Multiple vulnerabilities (b0395fb0-d45c-11f1-985e-901b0edee044)
high Nessus Plugin ID 374539
Synopsis
The remote FreeBSD host is missing one or more security-related updates.Description
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b0395fb0-d45c-11f1-985e-901b0edee044 advisory.Bruno Alla reports:
An unauthenticated attacker can defeat Django's DATA_UPLOAD_MAX_MEMORY_SIZE limit and force a worker process to allocate arbitrary memory, by naming a compression codec in the Content-Type charset parameter. A 108-byte request body produces a 50,331,648-character value inside the view, an amplification factor of 466,033, and grows process peak RSS by about 97 MiB. No application configuration is required beyond DRF's default parser set; the endpoint only has to accept a JSON body.
Deleting an authentication token through TokenProxy silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling .delete() on a TokenProxy instance believes it has revoked a token that is still live.
DRF's content negotiation parses each Accept token several times per request and never limits the number of tokens or their total size. Each parse ends up in Django's parse_header_parameters, which takes quadratic time when a quoted parameter value is packed with semicolons. On my machine a single GET with a 780KB Accept header made of 96 such tokens kept one gunicorn worker busy for 18.87 seconds (Django 6.1, djangorestframework 3.18.0, gunicorn 26.0.0, Python 3.13, Docker on macOS). The header is syntactically valid, fits inside gunicorn's default header limits, and needs no authentication. Two concurrent requests, which is one per sync worker, made a default two worker deployment stop answering for my whole 40 second test window. It recovered half a second after I stopped sending.
Tenable has extracted the preceding description block directly from the FreeBSD security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
http://www.nessus.org/u?2ec9e660
http://www.nessus.org/u?56187361
Plugin Details
Severity: High
ID: 374539
File Name: freebsd_pkg_b0395fb0d45c11f1985e901b0edee044.nasl
Version: 1.1
Type: Local
Family: FreeBSD Local Security Checks
Published: 10/31/2026
Updated: 10/31/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.55
CVSS v2
Risk Factor: High
Base Score: 7.1
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N
CVSS Score Source: CVE-2026-114137
CVSS v3
Risk Factor: High
Base Score: 7.4
Temporal Score: 6.4
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:py311-dj61-djangorestframework, p-cpe:/a:freebsd:freebsd:py311-djangorestframework, p-cpe:/a:freebsd:freebsd:py312-dj60-djangorestframework, p-cpe:/a:freebsd:freebsd:py312-dj61-djangorestframework, p-cpe:/a:freebsd:freebsd:py312-djangorestframework, p-cpe:/a:freebsd:freebsd:py313-dj60-djangorestframework, p-cpe:/a:freebsd:freebsd:py313-dj61-djangorestframework, p-cpe:/a:freebsd:freebsd:py313-djangorestframework, p-cpe:/a:freebsd:freebsd:py313t-dj60-djangorestframework, p-cpe:/a:freebsd:freebsd:py313t-dj61-djangorestframework, p-cpe:/a:freebsd:freebsd:py313t-djangorestframework, p-cpe:/a:freebsd:freebsd:py314-dj60-djangorestframework, p-cpe:/a:freebsd:freebsd:py314-dj61-djangorestframework, p-cpe:/a:freebsd:freebsd:py314-djangorestframework, p-cpe:/a:freebsd:freebsd:py314t-dj60-djangorestframework, p-cpe:/a:freebsd:freebsd:py314t-dj61-djangorestframework, p-cpe:/a:freebsd:freebsd:py314t-djangorestframework, p-cpe:/a:freebsd:freebsd:py315-dj60-djangorestframework, p-cpe:/a:freebsd:freebsd:py315-dj61-djangorestframework, p-cpe:/a:freebsd:freebsd:py315-djangorestframework
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Exploit Ease: No known exploits are available
Patch Publication Date: 10/30/2026
Vulnerability Publication Date: 10/21/2026