From 21121e8bc101125081148aa07536320160e20880 Mon Sep 17 00:00:00 2001
From: briquet <benjamin.riquet@numerique.gouv.fr>
Date: Fri, 23 Oct 2026 21:21:24 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F(backend)=20upgrade=20djan?=
 =?UTF-8?q?gorestframework=20to=203.18.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix three vulnerabilities in djangorestframework

- CVE-2026-114136: a compressing codec in the Content-Type charset
  lets an unauthenticated body bypass Django's size limit,
  causing memory-amplification denial of service
- CVE-2026-114137: TokenProxy.delete() reports success without deleting
  the token
- CVE-2026-114138: crafted Accept headers make content negotiation burn
  seconds of CPU per request, exhausting workers
---
 CHANGELOG.md               | 2 ++
 src/backend/pyproject.toml | 2 +-
 src/backend/uv.lock        | 8 ++++----
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6f7d0ef55..1fe424e8f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,8 @@ and this project adheres to
 - 🔒️(frontend) upgrade nginx to 1.30.6 to fix CVE-2026-15176
 - 🔒️(docker) upgrade brotli-libs to 1.2.1 to fix CVE-2026-111497
 - 🔒️(frontend) build the Outlook add-in on Node 22.23.4
+- 🔒️(backend) upgrade djangorestframework to 3.18.2 to fix CVE-2026-114136,
+  CVE-2026-114137 and CVE-2026-114138
 
 ## [1.36.2] - 2026-10-21
 
diff --git a/src/backend/pyproject.toml b/src/backend/pyproject.toml
index 90ab7f9a9..8ee165f41 100644
--- a/src/backend/pyproject.toml
+++ b/src/backend/pyproject.toml
@@ -41,7 +41,7 @@ dependencies = [
     "django-timezone-field>=5.1",
     "django-pydantic-field==0.5.4",
     "django==5.2.17",
-    "djangorestframework==3.18.0",
+    "djangorestframework==3.18.2",
     "drf_spectacular==0.30.0",
     "dockerflow==2026.3.4",
     "easy_thumbnails==2.10.1",
diff --git a/src/backend/uv.lock b/src/backend/uv.lock
index 6cbd2a094..57dc8dafc 100644
--- a/src/backend/uv.lock
+++ b/src/backend/uv.lock
@@ -929,14 +929,14 @@ wheels = [
 
 [[package]]
 name = "djangorestframework"
-version = "3.18.0"
+version = "3.18.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "django" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/79/bc/de04e3d4dc65e8b926700956ee70d4f084f2005603d21122d4d0683006fd/djangorestframework-3.18.0.tar.gz", hash = "sha256:2323a5111837e0b784dcb8323abc78ecc54fa2a5af7aff2677cf50cdd849477f", size = 913667, upload-time = "2026-08-07T14:53:33.571Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/3f/8b/2f048189610d58b29ae947f46d9c7d19c20ba427568eac906d6a2277d391/djangorestframework-3.18.2.tar.gz", hash = "sha256:8249bad7715eb37274ce5820fc5d9fd786b7579806589565f52a71c02b35f54b", size = 923551, upload-time = "2026-10-06T20:42:15.116Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/51/d7/7461738e819b853275b35fd35712a85806c09a327e1fd5f8ff766bdd317e/djangorestframework-3.18.0-py3-none-any.whl", hash = "sha256:381fc44d3249c9565c5f723850855b734e99030eb30957a49f506d3fe11d7dcb", size = 900032, upload-time = "2026-08-07T14:53:31.881Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/9e/81e5bfbba54f7396233df979befde49e6e13c94c2df21b94555684dddd3e/djangorestframework-3.18.2-py3-none-any.whl", hash = "sha256:a92d6a4e128a2550bd2fe2e02008a9e47fe52c180e130bb438f5ba70ee933a3f", size = 903990, upload-time = "2026-10-06T20:42:13.411Z" },
 ]
 
 [[package]]
@@ -1446,7 +1446,7 @@ requires-dist = [
     { name = "django-redis", specifier = "==7.0.0" },
     { name = "django-storages", extras = ["s3"], specifier = "==1.14.6" },
     { name = "django-timezone-field", specifier = ">=5.1" },
-    { name = "djangorestframework", specifier = "==3.18.0" },
+    { name = "djangorestframework", specifier = "==3.18.2" },
     { name = "dockerflow", specifier = "==2026.3.4" },
     { name = "drf-spectacular", specifier = "==0.30.0" },
     { name = "easy-thumbnails", specifier = "==2.10.1" },