Encode vulnerabilities
We track 7 vulnerabilities in Encode products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 21, 2026.
Latest Encode vulnerabilities
- 7.5 High severity
django-rest-framework: Uncontrolled Resource Consumption
Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer in that file repeatedly
- 7.4 High severity
django-rest-framework: Detection of Error Condition Without Action
Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a dele
- 7.5 High severity
django-rest-framework: Improper Handling of Highly Compressed Data (Data Amplification)
Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec ra
- 8.7 High severity
starlette: Allocation of Resources Without Limits or Throttling
Starlette is an Asynchronous Server Gateway Interface (ASGI) framework/toolkit. Prior to version 0.40.0, Starlette treats `multipart/form-data` parts without a `filename` as text form fields and buffers those in byte strings with no size limit. This allows an
- 7.5 High severity
python-multipart: Inefficient Regular Expression Complexity
`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is ver
- 7.5 High severity
Starlette: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.
- 7.5 High severity
Starlette: Uncontrolled Resource Consumption
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the H