From 61287458fa7954e6a9da7aceeed78ad46033a63b Mon Sep 17 00:00:00 2001
From: winklemad <winklemad@outlook.com>
Date: Fri, 17 Jul 2026 06:42:25 +0530
Subject: [PATCH] Reject non-finite values in FloatField.to_internal_value

FloatField accepted nan, inf, -inf and overflow-to-inf strings such as
"1e400", returning float('nan')/float('inf') instead of raising a
ValidationError. It was the only numeric field without a finiteness
guard: IntegerField and DecimalField already reject these, as does
Django's own forms.FloatField.

REST framework renders JSON with allow_nan=False to stay spec-compliant,
so a non-finite value accepted here raises "Out of range float values
are not JSON compliant" when the object is later serialized, turning a
validation gap into a 500 error.

Guard to_internal_value with math.isfinite, mirroring DecimalField's
is_nan check and Django's forms.FloatField.
---
 rest_framework/fields.py | 8 +++++++-
 tests/test_fields.py     | 8 +++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/rest_framework/fields.py b/rest_framework/fields.py
index 9eb2a50a8b..0a151e7b4c 100644
--- a/rest_framework/fields.py
+++ b/rest_framework/fields.py
@@ -4,6 +4,7 @@
 import decimal
 import functools
 import inspect
+import math
 import re
 import uuid
 import warnings
@@ -973,12 +974,17 @@ def to_internal_value(self, data):
             self.fail('max_string_length')
 
         try:
-            return float(data)
+            value = float(data)
         except (TypeError, ValueError):
             self.fail('invalid')
         except OverflowError:
             self.fail('overflow')
 
+        if not math.isfinite(value):
+            self.fail('invalid')
+
+        return value
+
     def to_representation(self, value):
         return float(value)
 
diff --git a/tests/test_fields.py b/tests/test_fields.py
index 869219a588..47d44e77ae 100644
--- a/tests/test_fields.py
+++ b/tests/test_fields.py
@@ -1243,7 +1243,13 @@ class TestFloatField(FieldValues):
         0.0: 0.0,
     }
     invalid_inputs = {
-        'abc': ["A valid number is required."]
+        'abc': ["A valid number is required."],
+        'nan': ["A valid number is required."],
+        'inf': ["A valid number is required."],
+        '-inf': ["A valid number is required."],
+        '1e400': ["A valid number is required."],
+        float('nan'): ["A valid number is required."],
+        float('inf'): ["A valid number is required."],
     }
     outputs = {
         '1': 1.0,