CVE-2026-6907
Cache Poisoning in Django via Vary Header Asterisk
Publication date: 2026-05-05
Last updated on: 2026-05-07
Assigner: Django Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| djangoproject | django | From 5.2 (inc) to 5.2.14 (exc) |
| djangoproject | django | From 6.0 (inc) to 6.0.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-524 | The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Django versions before 6.0.5 and 5.2 before 5.2.14, where the UpdateCacheMiddleware component incorrectly caches requests that have a Vary header containing an asterisk ('*').
Because of this erroneous caching behavior, private data that should not be cached or shared can be stored and served to unintended users.
Earlier unsupported Django versions such as 5.0.x, 4.1.x, and 3.2.x may also be affected by this issue.
How can this vulnerability impact me? :
The impact of this vulnerability is that private or sensitive data may be cached and subsequently served to unauthorized users.
This can lead to unintended data exposure, compromising user privacy and potentially leaking confidential information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability in Django's UpdateCacheMiddleware can lead to private data being stored and served incorrectly due to erroneous caching when the Vary header contains an asterisk. Such unintended exposure or mishandling of private data could potentially impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on the confidentiality and proper handling of personal and sensitive information.
However, the provided information does not explicitly describe the direct effects on compliance with these standards or any mitigation steps related to regulatory requirements.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Django to a fixed version. Specifically, update to Django 6.0.5 or later if you are using the 6.0 series, or to 5.2.14 or later if you are using the 5.2 series.
Earlier unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x may also be affected, so consider upgrading to a supported and patched version.