Technical impact
Django REST framework versions before 3.18.2 process every Accept header token without limits, repeatedly parsing large quoted parameters for each renderer. A malicious client can send a long list of media types with extensive parameters, causing the server to expend disproportionate CPU time and hold up synchronous workers. This results in significant service slowdown or unavailability for legitimate traffic.
Affected Systems
The vulnerability impacts any installation of the Django REST framework library encoded as "encode:django-rest-framework" running a version earlier than 3.18.2. Systems exposing API endpoints that use default content negotiation are potentially exposed.
Risk and Exploitability
The CVSS score of 7.5 points to a high severity threat. The EPSS score is < 1% (0.00432), indicating a very low probability that exploitation is actively occurring, and the vulnerability is not listed in CISA KEV. A remote, unauthenticated attacker can exploit it by crafting HTTP requests with many Accept header tokens; the attack requires no authentication and can be launched from any Internet‑reachable host. Successful exploitation can tie up workers for extended periods, making the API unresponsive to legitimate users.
Github GHSA