Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-48587: Django may expose private data through Vary header
CVE-2026-48587 · published 5 months ago
Summary
Django versions before 5.2.15 and 6.0.6 do not remove extra spaces from the Vary header when checking cached pages. An attacker could add spaces to the header and trick the server into revealing cached content that should be private. Upgrade Django to the latest patch level or apply the recommended configuration change to clean the header before use.
What to do
- Update django to version 6.0.6.
- Update django software foundation django to version 5.2.15.
- Update django software foundation django to version 6.0.6.
- Update debian python-django to version 3:3.2.25-0+deb12u5.
- Update debian python-django to version 3:5.2.15-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | python-django | All versions |
| Debian:12 | debian | python-django |
< 3:3.2.25-0+deb12u5 Fix: upgrade to 3:3.2.25-0+deb12u5
|
| Debian:13 | debian | python-django | All versions |
| Debian:14 | debian | python-django |
< 3:5.2.15-1 Fix: upgrade to 3:5.2.15-1
|
| – | djangoproject | django |
>= 5.2, < 5.2.15 >= 6.0, < 6.0.6 cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* |
| Bitnami | – | django |
>= 6.0.0, < 6.0.6 Fix: upgrade to 6.0.6
|
| Ubuntu:Pro:14.04:LTS | canonical | python-django | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | python-django | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | python-django | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | python-django | All versions |
| Ubuntu:22.04:LTS | canonical | python-django | All versions |
| Ubuntu:24.04:LTS | canonical | python-django | All versions |
| Ubuntu:25.10 | canonical | python-django | All versions |
| Ubuntu:26.04:LTS | canonical | python-django | All versions |
| pip | django software foundation | django |
< 5.2.15 Fix: upgrade to 5.2.15
|
| PyPI | django software foundation | django |
>= 6.0, < 6.0.6 Fix: upgrade to 6.0.6
|
Original advisory text
Potential exposure of private data via whitespace padding in Vary header
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
`django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Navid Rezazadeh for reporting this issue.
`django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Navid Rezazadeh for reporting this issue.
References
- https://security-tracker.debian.org/tracker/CVE-2026-48587 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-48587 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-48587 Third Party Advisory
- https://docs.djangoproject.com/en/dev/releases/security
- https://www.djangoproject.com/weblog/2026/jun/03/security-releases
- https://github.com/django/django/commit/1721035a72624aad7b38dd19b14013efd94b24b8
- https://github.com/django/django/commit/42aa0b3364d312e7c6472258d8b0e9c0277fbf22
- https://github.com/django/django/commit/9b62b0af71a14c657d19d95371630ba839e83d9a
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-198....
- https://github.com/advisories/GHSA-923m-gv2p-w5qp
- https://github.com/django/django/ URL
- https://github.com/django/django Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48587... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-48587 Vendor Advisory
- https://docs.djangoproject.com/en/dev/releases/security/ Vendor Advisory
- https://www.djangoproject.com/weblog/2026/jun/03/security-releases/ Vendor Advisory
- https://groups.google.com/g/django-announce Third Party Advisory
- https://pypi.org/project/Django/ Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-1023Incomplete Comparison with Missing Factors
Timeline
Published3 Jun 2026
Updated4 Nov 2026
First seen3 Jun 2026
Sources
DEBIAN-CVE-2026-48587 · OSV
UBUNTU-CVE-2026-48587 · OSV
CVE-2026-48587 · NVD
BIT-django-2026-48587 · OSV
GHSA-923m-gv2p-w5qp · GHSA
PYSEC-2026-198 · OSV
GHSA-923m-gv2p-w5qp · OSV
CVE-2026-48587 · OSV
Track software like this
Free during beta