django-tastypie CVE-2026-16208

Q: What is the CVSS score of CVE-2026-16208?

CVE-2026-16208 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45419 LOW

Race Condition (CWE-362)

2026-07-19 VulDB

GHSA-j4r9-g979-rc2x

Python Information Disclosure Race Condition Django Tastypie

2.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.0 MEDIUM

Network-exploitable race condition requiring authenticated access (PR:L) and precise timing (AC:H), with uniform low CIA impact and no scope change.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 19, 2026 - 04:01 vuln.today

DescriptionCVE.org

A flaw has been found in django-tastypie up to 0.15.1. The affected element is the function CacheThrottle/CacheDBThrottle of the file tastypie/throttle.py. This manipulation causes race condition. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is described as difficult. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Race condition in django-tastypie's throttle module (versions up to 0.15.1) allows authenticated remote users to bypass API rate limiting controls by exploiting a time-of-check to time-of-use (TOCTOU) window in the CacheThrottle and CacheDBThrottle classes. The CVSS 4.0 score of 2.3 with high attack complexity (AC:H) and low-privilege requirement (PR:L) reflects the limited real-world risk; impacts are constrained to minor information disclosure and throttle bypass without subsequent-system effects. No public exploit has been identified and the project maintainers have not yet responded to the disclosure.

Technical ContextAI

django-tastypie is a Python REST API framework built on Django, providing resource-based API routing with built-in throttling support. The vulnerable components are the CacheThrottle and CacheDBThrottle classes in tastypie/throttle.py, which use Django's cache backend to track per-user request counts for rate limiting. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) identifies the root cause: the throttle check-and-increment sequence is not executed atomically, creating a TOCTOU window. When multiple concurrent requests arrive simultaneously from the same authenticated user, each can independently read the current throttle count before any of them writes an incremented value back, allowing all requests to pass the throttle check before the counter reflects the true request volume. The CPE cpe:2.3:a:n/a:django-tastypie:*:*:*:*:*:*:*:* covers all versions through 0.15.1.

RemediationAI

No vendor-released patch has been identified at time of analysis; the project maintainers have not responded to the vulnerability disclosure per the GitHub issue at https://github.com/django-tastypie/django-tastypie/issues/1700, and no patched release version is confirmed. Monitor that issue for upstream resolution. As a compensating control, operators should implement rate limiting at the infrastructure layer - for example, nginx's limit_req_zone directive or an API gateway (AWS API Gateway throttling, Kong rate-limiting plugin) - which enforces limits before requests reach the Python application and is not subject to application-layer race conditions, though the semantics shift from per-authenticated-user to per-IP or per-API-key depending on configuration. If the tastypie throttle is not a critical security boundary and is used only as a courtesy limit, the risk may be accepted pending an upstream patch. Restricting API access to trusted clients reduces the authenticated attacker pool, though this limits public-facing API use cases. Watch https://github.com/django-tastypie/django-tastypie/issues/1700 and the PyPI release page for a patched release.