REF: https://portswigger.net/daily-swig/ip-spoofing-bug-leaves-django-rest-applications-open-to-ddos-password-cracking-attacks Reported Date: Jan 11 2022
I did some research into the link you shared, Django's source and Django REST Framework's source.
Bare-bones Django is not vulnerable to this, since it doesn't uses X-Forwarded-For, and neither is Python.
Virtually all versions of Django REST Framework are vulnerable, since this commit 9 years ago added the HTTP_X_FORWARDED_FOR check: https://github.com/encode/django-rest-framework/blob/d18d32669ac47178f26409f149160dc2c0c5359c/rest_framework/throttling.py#L155
For measures you can take to avoid this, since a patch is not yet available, you could implement your own ratelimitter, and replace get_ident to only use REMOTE_ADDR.
If your Djando REST Framework application is behind a proxy, you might not be vulnerable to this.
