djangorestframework-3.15.2-py3-none-any.whl: 2 vulnerabilities (highest severity is: 5.3)

[mend-bolt-for-github]

Vulnerable Library - djangorestframework-3.15.2-py3-none-any.whl

Web APIs for Django, made easy.

Library home page: https://files.pythonhosted.org/packages/7c/b6/fa99d8f05eff3a9310286ae84c4059b08c301ae4ab33ae32e46e8ef76491/djangorestframework-3.15.2-py3-none-any.whl

Sample Path to Dependency File: /default/dockerbuild/react-ui/crud-app/backend/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019411/env/lib/python3.8/site-packages/djangorestframework-3.15.2.dist-info

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (djangorestframework version)	Remediation Possible**
CVE-2026-73228	Medium	5.3	djangorestframework-3.15.2-py3-none-any.whl	Direct	3.17.2	❌
CVE-2026-73229	Medium	4.3	djangorestframework-3.15.2-py3-none-any.whl	Direct	3.17.2	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-73228

Vulnerable Library - djangorestframework-3.15.2-py3-none-any.whl

Web APIs for Django, made easy.

Library home page: https://files.pythonhosted.org/packages/7c/b6/fa99d8f05eff3a9310286ae84c4059b08c301ae4ab33ae32e46e8ef76491/djangorestframework-3.15.2-py3-none-any.whl

Sample Path to Dependency File: /default/dockerbuild/react-ui/crud-app/backend/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019411/env/lib/python3.8/site-packages/djangorestframework-3.15.2.dist-info

Dependency Hierarchy:

• ❌ djangorestframework-3.15.2-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.

Publish Date: 2026-08-11

URL: CVE-2026-73228

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-11

Fix Resolution: 3.17.2

Step up your Open Source Security Game with Mend here

CVE-2026-73229

Vulnerable Library - djangorestframework-3.15.2-py3-none-any.whl

Web APIs for Django, made easy.

Library home page: https://files.pythonhosted.org/packages/7c/b6/fa99d8f05eff3a9310286ae84c4059b08c301ae4ab33ae32e46e8ef76491/djangorestframework-3.15.2-py3-none-any.whl

Sample Path to Dependency File: /default/dockerbuild/react-ui/crud-app/backend/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019411/env/lib/python3.8/site-packages/djangorestframework-3.15.2.dist-info

Dependency Hierarchy:

• ❌ djangorestframework-3.15.2-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2.

Publish Date: 2026-08-11

URL: CVE-2026-73229

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-11

Fix Resolution: 3.17.2

Step up your Open Source Security Game with Mend here