Django up to 5.2.14/6.0.5 Response Header django.utils.cache.has_vary_header incomplete comparison with missing factors

Summaryinfo

A vulnerability described as problematic has been identified in Django up to 5.2.14/6.0.5. This affects the function django.utils.cache.has_vary_header of the component Response Header Handler. Executing a manipulation can lead to incomplete comparison with missing factors. This vulnerability appears as CVE-2026-48587. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in Django up to 5.2.14/6.0.5. This vulnerability affects the function django.utils.cache.has_vary_header of the component Response Header Handler. The manipulation with an unknown input leads to a incomplete comparison with missing factors vulnerability. The CWE definition for the vulnerability is CWE-1023. The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors. As an impact it is known to affect confidentiality. CVE summarizes:

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Navid Rezazadeh for reporting this issue.

The weakness was presented by Navid Rezazadeh. The advisory is shared for download at docs.djangoproject.com. This vulnerability was named CVE-2026-48587 since 05/21/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/03/2026).

Upgrading to version 5.2.15 or 6.0.6 eliminates this vulnerability. The upgrade is hosted for download at docs.djangoproject.com.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Content Management System

Name

• Django

Version

• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5
• 5.2.6
• 5.2.7
• 5.2.8
• 5.2.9
• 5.2.10
• 5.2.11
• 5.2.12
• 5.2.13
• 5.2.14
• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion