The vulnerability arises because Django REST framework’s JSONParser uses the Content‑Type charset supplied by the client and passes it directly to codecs.getreader. This function accepts byte‑transform codecs, such as bz2_codec, allowing compressed data to be decompressed after the framework has already enforced the DATA_UPLOAD_MAX_MEMORY_SIZE limit on the raw request bytes. A remote unauthenticated client can thus send a very small request that expands to consume a large portion of per‑worker memory. The result is a denial of service that can exhaust worker processes and interrupt service availability. This weakness involves improper validation of input and unchecked use of external codecs.

The affected product is Django REST framework, a toolkit for building Web APIs. Versions starting at 3.6.4 up to and including 3.18.1 are vulnerable. The vulnerability is fixed by upgrading to version 3.18.2 or later.

The CVSS score of 7.5 indicates a high severity risk. The EPSS score is not available, but the lack of a known exploit and absence from the CISA KEV catalog suggest that exploitation has not yet been observed. Based on the description, it is inferred that the attacker can send a crafted request from an unauthenticated remote client to any reachable endpoint that accepts a JSON body, potentially leading to memory exhaustion. Efforts to mitigate this risk should focus on patching and restricting content types.