  
      def parse(self, stream, media_type=None, parser_context=None):
          parser_context = parser_context or {}
          encoding = parser_context.get('encoding', settings.DEFAULT_CHARSET)
          parser = ET_XMLParser(encoding=encoding)
          try:
              tree = ET.parse(stream, parser=parser)
          except (ExpatError, ETParseError, ValueError) as exc:
              raise ParseError('XML parse error - %s' % six.u(exc))
          data = self._xml_convert(tree.getroot())
 
</s> remove             tree = ET.parse(stream, parser=parser)
        except (ExpatError, ETParseError, ValueError) as exc:
 </s> add             tree = etree.parse(stream, parser=parser)
        except (etree.ParseError, ValueError) as exc:
        parser = etree.DefusedXMLParser(encoding=encoding)
  
      def parse(self, stream, media_type=None, parser_context=None):
          parser_context = parser_context or {}
          encoding = parser_context.get('encoding', settings.DEFAULT_CHARSET)
        parser = etree.DefusedXMLParser(encoding=encoding)
          try:
              tree = ET.parse(stream, parser=parser)
          except (ExpatError, ETParseError, ValueError) as exc:
              raise ParseError('XML parse error - %s' % six.u(exc))
          data = self._xml_convert(tree.getroot())
keep keep keep keep replace keep keep keep keep keep
 defusedxml for security fix.

As per:
http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html 
rest_framework/parsers.py