FreeBSD : py-djangorestframework -- Multiple vulnerabilities (b0395fb0-d45c-11f1-985e-901b0edee044)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b0395fb0-d45c-11f1-985e-901b0edee044 advisory. Bruno Alla reports: An unauthenticated attacker can defeat Django's DATAUPLOADMAXMEMORYSIZE...

Django REST Framework: TokenProxy.delete() Reports Success And Revokes Nothing

Summary Deleting an authentication token through "TokenProxy" silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling...

GHSA-XW6W-GCFP-CF8M Django REST framework: TokenProxy.delete() reports success and revokes nothing

Summary Deleting an authentication token through TokenProxy silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling .dele...

Django REST framework: TokenProxy.delete() reports success and revokes nothing

Summary Deleting an authentication token through TokenProxy silently deletes nothing. The call raises no exception and reports success, the database row survives, and the token keeps authenticating. Any application, admin integration or operational script that revokes credentials by calling .dele...

CVE-2026-114137

A flaw was found in Django REST Framework. When an application attempts to revoke authentication credentials using the TokenProxy component, the deletion query targets an incorrect identifier, causing the deletion to silently fail without raising an error. Consequently, revoked credentials remain...

py-djangorestframework -- Multiple vulnerabilities

Bruno Alla reports: An unauthenticated attacker can defeat Django's "DATAUPLOADMAXMEMORYSIZE" limit and force a worker process to allocate arbitrary memory, by naming a compression codec in the Content-Type charset parameter. A 108-byte request body produces a 50,331,648-character value inside th...

WS-2026-0107

Django REST framework 3.12.0 before 3.18.2: TokenProxy.pk returns the user id instead of the token key, so deleting a token through the admin or TokenProxy.delete reports success but revokes nothing and the token stays valid. GHSA-xw6w-gcfp-cf8m...

Admin/owner role lockout possible

Lines of code Vulnerability details Impact In the cash part of the code, the contract TokenProxy in Proxy.sol serves as a generic proxy for all tokens deployed using factory contracts. The factory contracts deploy a ProxyAdmin contract and a TokenProxy, alongside the respective token...