GitHub Advisoryadvisory · PyPI

GHSA-5hrc-gvxj-w55p Django Uses Cache Containing Sensitive Information

LOW Published 2026-05-05 Modified 2026-06-06 Official page ↗
Aliases
CVE-2026-6907
Ecosystem
PyPI
Packages
Django
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-524
Reviewed
2026-05-08

Affected packages

• PyPI Django: >= 6.0, < 6.0.5 → fixed in 6.0.5 • PyPI Django: >= 5.2, < 5.2.14 → fixed in 5.2.14

Description

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django thanks Ahmad Sadeddin for reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-6907 An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. vulnerability

Weakness · CWE (1)

  • CWE-524 Use of Cache Containing Sensitive Information weakness

References