CVE-2026-114137
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In Django REST framework from 3.12.0 until 3.18.2, TokenProxy.delete() uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and reports zero deletions without raising an error. Applications or scripts revoking credentials through a TokenProxy instance may believe revocation succeeded while the token remains live and continues authenticating, and DRF tokens do not expire automatically.
Risk Assessment
Revoked tokens may remain active indefinitely, allowing unauthorized access by anyone holding a leaked or captured token.
Recommendation
Upgrade Django REST framework to version 3.18.2 or later. Verify and manually remove tokens that were supposed to be revoked via TokenProxy.
Other vulnerabilities in Django REST framework
See all- CVE-2026-114138High
Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer in that file repeatedly invokes _MediaType parsing from rest_framework/utils/mediatypes.py for each attacker-controlled token, every renderer, and forced 406 renegotiation. A remote unauthenticated client can send many distinct media types containing large quoted parameter values with numerous semicolons, causing Django's parameter parser and DRF's repeated parsing structure to consume disproportionate CPU. Requests to any reachable endpoint can pin synchronous workers for prolonged periods, and concurrent requests can make the service unavailable until the requests stop. This issue is fixed in version 3.18.2.
- CVE-2026-114136High
Django REST framework versions 3.6.4 through 3.18.2 use the client-supplied Content-Type charset value with codecs.getreader, accepting byte-transform codecs such as bz2_codec. A remote unauthenticated client can send a compressed JSON body that is expanded after DATA_UPLOAD_MAX_MEMORY_SIZE is enforced, consuming substantial per-worker memory.
- CVE-2026-73229Medium
Django REST framework prior to 3.17.2 has a vulnerability in AdminRenderer.render() that uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access.
- CVE-2026-73228Medium
Django REST framework prior to 3.17.2 has a vulnerability in request.data parsing in rest_framework/request.py Request._parse(), which passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2.
Original NVD description (English source)
Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and reports zero deletions without raising an error. Applications, administrative integrations, or operational scripts that revoke credentials through a TokenProxy instance can therefore believe revocation succeeded while the token remains live and continues authenticating. DRF's own TokenAdmin.delete_model workaround is not affected, but other callers can leave access available indefinitely because DRF tokens do not expire automatically. This issue is fixed in version 3.18.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS