Executive brief
A flaw was found in django-tastypie, a framework used to create APIs for Django applications. The software's rate-limiting feature, which is designed to prevent users from making too many requests, can be bypassed by sending multiple requests at the exact same time. This could allow an attacker to overwhelm a service or perform more actions than the system's policy should allow.
Technical details
A race condition exists in the CacheThrottle and CacheDBThrottle classes within tastypie/throttle.py. The vulnerability stems from the use of non-atomic read/modify/write operations when checking and updating throttle limits in the cache backend. Because the check and the logging of the access are not synchronized, multiple concurrent requests can pass the throttle check before any of them increment the counter. An attacker with network access and valid credentials can exploit this to exceed configured rate limits. As of the advisory date, the project has been notified but a formal patch has not been released.
Affected products
- django-tastypie django-tastypie <= 0.15.1
Timeline
- 2026-06-13: disclosed: Issue reported to the project maintainers via GitHub issue #1700
- 2026-07-19: advisory: CVE published to the NVD dataset