CVE-2026-16208: django-tastypie throttle.py CacheDBThrottle race condition

Severity: medium (CVSS 5.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-19 · updated 2026-07-22
Weakness: CWE-362

Description

A flaw has been found in django-tastypie up to 0.15.1. The affected element is the function CacheThrottle/CacheDBThrottle of the file tastypie/throttle.py. This manipulation causes race condition. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is described as difficult. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

django-tastypie: 0.15.0, 0.15.1

References

https://github.com/django-tastypie/django-tastypie/
https://github.com/django-tastypie/django-tastypie/issues/1700
https://vuldb.com/cve/CVE-2026-16208
https://vuldb.com/submit/857925
https://vuldb.com/vuln/380024
https://vuldb.com/vuln/380024/cti

Get alerted when CVE-2026-16208 or the next vulnerability affects your stack