BIT-django-2026-8404

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/django/BIT-django-2026-8404.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-django-2026-8404
Aliases
Published
2026-06-06T08:39:25.918Z
Modified
2026-06-06T10:41:27.896671381Z
Summary
Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware
Details

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.middleware.cache.UpdateCacheMiddleware in Django does not match Cache-Control response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their Cache-Control directives used uppercase or mixed-case values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmed Badawe for reporting this issue.

Database specific 
{
    "severity": "Low",
    "cpes": [
        "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*"
    ]
}
References

Affected packages

Bitnami / django

Package

Name
django
Purl
pkg:bitnami/django

Severity

  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
5.2.0
Fixed
5.2.15
Introduced
6.0.0
Fixed
6.0.6

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/django/BIT-django-2026-8404.json"