Zain Nadeem

Responsible disclosure / Technical analysis

Security Research

Original analysis of verified public advisories reported by Zain Nadeem, with scoped impact, remediation detail, and direct links to authoritative project records.

Django REST Framework

CVE-2026-73228

Potential bypass of Django DATA_UPLOAD_MAX_MEMORY_SIZE when parsing oversized JSON and urlencoded request bodies via DRF request.data

DRF could parse oversized JSON and urlencoded request bodies through request.data without enforcing Django’s configured in-memory upload limit, weakening an application-level resource-consumption safeguard.

GHSA-2m8g-3cmr-wg3w

ModeratePublishedCredited reporter: Zain Nadeem
Read technical analysis Official advisory
Django REST Framework

CVE-2026-73229

AdminRenderer may disclose GET-protected data when rendering invalid write requests

When rendering an invalid write request, AdminRenderer could invoke a view’s GET handler and include representation data that the same requester would be denied through a direct GET request.

GHSA-g47c-3xmw-q6m2

ModeratePublishedCredited reporter: Zain Nadeem
Read technical analysis Official advisory
CyberChef

CVE-2026-72912

CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL

A malformed pretty-recipe URL fragment could trigger inefficient regular-expression processing in the client-side parser, causing prolonged CPU usage and making the page unresponsive.

GHSA-w74r-jxjh-gwr6

ModeratePublishedCredited reporter: Zain Nadeem
Read technical analysis Official advisory

Back to research overview