GHSA-8cjm-8mp7-r2xf
Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-8404
- Alias
- BIT-django-2026-8404, PYSEC-2026-201
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmed Badawe for reporting this issue.
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · django | introduced 0, fixed 5.2.15 |
| PyPI · django | introduced 6.0.0, fixed 6.0.6 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2026-8404 ADVISORY
- https://github.com/django/django/commit/366d9ae6e8d1469c04e9ebdc1bcd098fc14a3b1e WEB
- https://github.com/django/django/commit/b4330259ffbe1a031ed14daab1f35697460f10f2 WEB
- https://github.com/django/django/commit/d618d7ae4fec727d5b582bd24f803c28d17bf7cd WEB
- https://docs.djangoproject.com/en/dev/releases/security WEB
- https://github.com/django/django PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-201.yaml WEB
- https://groups.google.com/g/django-announce WEB
- https://www.djangoproject.com/weblog/2026/jun/03/security-releases WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |