GHSA-qpc8-7fxc-cm4p
Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-35193
- Alias
- BIT-django-2026-35193, PYSEC-2026-197
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Shai Berger for reporting this issue.
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · django | introduced 5.2.0, fixed 5.2.15 |
| PyPI · django | introduced 6.0.0, fixed 6.0.6 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2026-35193 ADVISORY
- https://github.com/django/django/commit/050a3dc276f9142067260e990e4d8d42d5e32863 WEB
- https://github.com/django/django/commit/664652f1a2dd80d8a4cd491b4313cad915ae6669 WEB
- https://github.com/django/django/commit/a2faa8e895926ac5d63f72879b5ccf671b5b4ba9 WEB
- https://docs.djangoproject.com/en/dev/releases/security WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-197.yaml WEB
- https://groups.google.com/g/django-announce WEB
- https://www.djangoproject.com/weblog/2026/jun/03/security-releases WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |