{"answers":{"affected":"2 open source packages ship an affected version, including djangorestframework.","exploited":"There is no known exploitation of CVE-2026-114137 in the wild and no public exploit code.","fix":"Upgrade djangorestframework to 3.18.2 or later.","what":"CVE-2026-114137 is a high-severity vulnerability in encode django-rest-framework, published on 21 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-114137 and fix it if it is affected.\n\nWhat it is: CVE-2026-114137 is a high-severity vulnerability in encode django-rest-framework, published on 21 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-114137 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- djangorestframework (PyPI): affected from 3.12.0; fixed in 3.18.2\n- djangorestframework (PyPI): affected from 3.12.0; fixed in 3.18.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-114137/ (Markdown: https://insights.sbomify.com/CVE-2026-114137/index.md)","id":"CVE-2026-114137","markdown":"https://insights.sbomify.com/CVE-2026-114137/index.md","name":"CVE-2026-114137","record":{"aliases":["DEBIAN-CVE-2026-114137","ECHO-33bc-b8a5-ee1f","GHSA-xw6w-gcfp-cf8m","ROOT-APP-PYPI-CVE-2026-114137","UBUNTU-CVE-2026-114137"],"analysis":null,"analysis_generated_by":null,"assigner":"GitHub_M","cpe":[],"cvss":{"score":7.4,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-613","name":"DEPRECATED: Insufficient Session Expiration"},{"id":"CWE-390","name":"Detection of Error Condition Without Action"}],"description":"Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and reports zero deletions without raising an error. Applications, administrative integrations, or operational scripts that revoke credentials through a TokenProxy instance can therefore believe revocation succeeded while the token remains live and continues authenticating. DRF's own TokenAdmin.delete_model workaround is not affected, but other callers can leave access available indefinitely because DRF tokens do not expire automatically. This issue is fixed in version 3.18.2.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Django REST framework: TokenProxy.delete() reports success and revokes nothing","id":"CVE-2026-114137","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":2,"n_references":3,"next":{"headline":"Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation","id":"CVE-2026-114138"},"packages":[{"ecosystem":"PyPI","fixed":["3.18.2"],"introduced":["3.12.0"],"last_affected":[],"package":"djangorestframework","purl":null,"source":"GHSA-xw6w-gcfp-cf8m"},{"ecosystem":"PyPI","fixed":["3.18.2"],"introduced":["3.12.0"],"last_affected":[],"package":"djangorestframework","purl":"pkg:pypi/djangorestframework","source":"GHSA-xw6w-gcfp-cf8m"}],"prev":{"headline":"Django REST framework: JSONParser applies an attacker-named codec to the request stream","id":"CVE-2026-114136"},"products":["django-rest-framework"],"published":"2026-10-21","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-23","vendors":["encode"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-114137/"}