This CVE exposes a silent protection failure: Django's DATA_UPLOAD_MAX_MEMORY_SIZE setting, which enforces a memory limit on request data and raises a clear exception when exceeded, is bypassed by Django REST Framework's parser layer without any warning, error, or indication to the developer. If you configured Django's memory limits per official guidance and then deployed DRF-based APIs, your protection was illusory — the limit was enforced at the Django view layer but silently ignored during DRF's parsing phase. There was no 413 error, no log warning, no signal that your security configuration had been nullified.
The critical failure here is ergonomic, not merely technical. Vanilla Django gives developers a feedback loop — a concrete exception they can catch, log, or handle. DRF removes that loop entirely. A team that followed documented security practices has been running unprotected against the exact DoS vector they believed they'd closed. That's a tooling failure with systemic consequences.
Upgrade to DRF 3.17.2 immediately. However, the patch only addresses the built-in JSONParser and FormParser. Audit any third-party DRF parsers or custom parsers in your codebase that inherit from DRF's base classes — these may independently replicate the same raw-stream behavior and remain unpatched. Treat any custom parser that calls request.stream directly as a potential bypass vector.
The broader architectural pattern matters: DRF is not the only framework layer that can silently undo Django's security boundaries. This CVE should prompt an audit of any middleware, parser, or wrapper that intercepts request flow before Django's security settings are applied. The implicit contract that upstream layers honor downstream protections is never enforced by Django itself — it's a gap in the framework's security model that each integration must now be audited against.