GitHub Advisoryadvisory · PyPI
GHSA-3h9f-r86x-qvjx Django: cache middleware may expose private responses when unrelated request cookies are present
LOW
Official page ↗
- Aliases
- CVE-2026-48588
- Ecosystem
- PyPI
- Packages
- django
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-524
- Reviewed
- 2026-08-07
Affected packages
• PyPI django: < 5.2.16 → fixed in 5.2.16
• PyPI django: >= 6.0.0, < 6.0.7 → fixed in 6.0.7
Description
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
`UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Chris Whyland for reporting this issue.
Related
Alias · CVE (1)
- CVE-2026-48588 An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. vulnerability
Weakness · CWE (1)
- CWE-524 Use of Cache Containing Sensitive Information weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-48588 advisory
- https://github.com/django/django/commit/64f9a2b2283fde3ec69fb0dfe441cf0f6f411ba3 web
- https://github.com/django/django/commit/6e365f8d01f2ba0bbd90968d76a42600fb8bc4b1 web
- https://github.com/django/django/commit/721685aa7799cc9327bd202cd1f70bd012ca95a7 web
- https://docs.djangoproject.com/en/dev/releases/security web
- https://github.com/django/django package
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2090.yaml web
- https://groups.google.com/g/django-announce web
- https://www.djangoproject.com/weblog/2026/jul/07/security-releases web