CVE-2026-113593

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.1.3 Django versions prior to 6.0.10 Django versions prior to 5.2.19

Description An issue exists where django.middleware.cache.UpdateCacheMiddleware and the django.views.decorators.cache.cache page() decorator generate identical cache keys for requests that omit a header listed in the response’s Vary header and requests that include that header with an empty value. This behavior could allow remote attackers to access private data cached for a different request.

Recommendations Update to version 6.1.3 or later. Update to version 6.0.10 or later. Update to version 5.2.19 or later.