PT-2026-37078
CVE-2026-6907
·
Published
2026-05-05
·
Updated
2026-09-30
Description by
CVSS 4.0
6.3
MediumMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Django versions 6.0 through 6.0.4
Django versions 5.2 through 5.2.13
Description
An issue in
django.middleware.cache.UpdateCacheMiddleware causes requests where the Vary header contains an asterisk ('*') to be erroneously cached. This behavior can lead to the storage and subsequent delivery of private data to unauthorized users.Recommendations
Update to version 6.0.5 for versions 6.0 through 6.0.4.
Update to version 5.2.14 for versions 5.2 through 5.2.13.
Found an issue in the description? Have something to add? Feel free to write us 👾