CVE-2026-16208
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In django-tastypie up to version 0.15.1, the CacheThrottle/CacheDBThrottle function in tastypie/throttle.py has a race condition vulnerability. The attack can be remote but is difficult to exploit. The project was informed but has not responded.
Risk Assessment
Risk of throttling bypass, potentially leading to server overload or unauthorized access.
Recommendation
Apply a temporary workaround (e.g., additional throttling safeguards) or monitor for vendor updates.
Other vulnerabilities in django-tastypie
See all- CVE-2011-4104High
The from_yaml method in serializers.py in Django Tastypie before version 0.9.10 does not properly deserialize YAML data, allowing remote attackers to execute arbitrary Python code.
- CVE-2026-16207Low
A vulnerability was found in django-tastypie up to version 0.15.1 in the ApiKeyAuthentication function within tastypie/authentication.py. The issue involves using the GET method with sensitive query strings, potentially leaking API keys. The attack is remote but has high complexity and is considered difficult to exploit.
Original NVD description (English source)
A flaw has been found in django-tastypie up to 0.15.1. The affected element is the function CacheThrottle/CacheDBThrottle of the file tastypie/throttle.py. This manipulation causes race condition. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is described as difficult. The project was informed of the problem early through an issue report but has not responded yet.