BIT-django-2026-48588

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/django/BIT-django-2026-48588.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-django-2026-48588

Aliases

Published

2026-07-12T23:39:37.767Z

Modified

2026-07-13T06:26:31.127966465Z

Summary

Potential exposure of private data via cached Set-Cookie response

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cache_page() decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.

Database specific

{
    "cpes": [
        "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*"
    ],
    "severity": "Low"
}

References

Affected packages

Bitnami / django

Package

Name: django
Purl: pkg:bitnami/django

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

5.2.0

Fixed

5.2.16

Introduced

6.0.0

Fixed

6.0.7

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/django/BIT-django-2026-48588.json"