Django REST Framework's request.data parsing bypasses the Django setting DATA_UPLOAD_MAX_MEMORY_SIZE when handling application/json or application/x-www-form-urlencoded bodies, allowing an attacker to send oversized payloads that consume more memory and CPU than intended. This uncontrolled resource consumption can lead to denial of service by exhausting server resources, as documented under CWE-400 and CWE-770.

Encode’s Django REST Framework, version 3.17.1 and earlier, is affected. The vulnerability exists in any deployment of DRF that uses its default request.data parser prior to the fix introduced in 3.17.2.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability can be triggered by a remote attacker sending a large JSON or form-encoded payload over HTTP, typically without needing authentication. The issue is not listed in CISA's KEV catalog, further indicating limited real-world exploitation to date.