GHSA-3h9f-r86x-qvjx
Django: cache middleware may expose private responses when unrelated request cookies are present
At a glance
- Published
- Updated
- CVE
- CVE-2026-48588
- Aliases
- BIT-django-2026-48588, PYSEC-2026-2090
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.
Affected packages
| Package | Versions |
|---|---|
| PyPI · django | introduced 0, fixed 5.2.16 |
| PyPI · django | introduced 6.0.0, fixed 6.0.7 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-48588 ADVISORY
- https://github.com/django/django/commit/64f9a2b2283fde3ec69fb0dfe441cf0f6f411ba3 WEB
- https://github.com/django/django/commit/6e365f8d01f2ba0bbd90968d76a42600fb8bc4b1 WEB
- https://github.com/django/django/commit/721685aa7799cc9327bd202cd1f70bd012ca95a7 WEB
- https://docs.djangoproject.com/en/dev/releases/security WEB
- https://github.com/django/django PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2090.yaml WEB
- https://groups.google.com/g/django-announce WEB
- https://www.djangoproject.com/weblog/2026/jul/07/security-releases WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |