CVE-2026-48587: Django information disclosure via whitespace padding in Vary header

Executive brief

Django is a popular web framework used to build and manage websites. A flaw in how it handles certain web headers could allow an attacker to view cached data that they should not have access to. This occurs when specific technical settings (Vary headers) contain extra spaces, potentially leading to the exposure of sensitive information stored in the web cache.

Technical details

A vulnerability exists in django.utils.cache.has_vary_header() where the function fails to strip leading or trailing whitespace from 'Vary' response header values before performing a comparison. This incomplete comparison (CWE-1023) can lead to cache key mismatches or incorrect cache hits. A remote attacker can exploit this to read cached responses by sending requests to URLs where the server-side response includes whitespace-padded Vary headers. The issue is fixed in Django versions 5.2.15 and 6.0.6.

Affected products

• Django Software Foundation Django < 5.2.15, >= 6.0.0, < 6.0.6

Timeline

• 2026-06-03: disclosed
• 2026-06-03: patched
• 2026-06-03: advisory

References

• https://api.github.com/users/cgurnik
• https://github.com/cgurnik
• https://api.github.com/users/cgurnik/gists%7B/gist_id%7D
• https://api.github.com/users/cgurnik/repos
• https://avatars.githubusercontent.com/u/720008?v=4
• https://api.github.com/users/cgurnik/events%7B/privacy%7D