Is CVE-2026-48587 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48587 being exploited in the wild.

How severe is CVE-2026-48587?

Low severity, with a CVSS score of 3.1, published 3 June 2026.

Which products and versions are affected?

Django (PyPI) ECOSYSTEM:introduced=0,fixed=5.2.15, ECOSYSTEM:introduced=5.2,fixed=5.2.15,introduced=6.0,fixed=6.0.6.

Is there a fix for CVE-2026-48587?

Yes. Django (PyPI): upgrade to 5.2.15, 6.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48587 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48587?

Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48587: Django information disclosure via whitespace padding in Vary header

CVE-2026-48587 · Severity: low · CVSS 3.1 · Published 2026-06-03

Django is a popular web framework used to build and manage websites. A flaw in how it handles certain web headers could allow an attacker to view cached data that they should not have access to. This occurs when specific technical settings (Vary headers) contain extra spaces, potentially leading to the exposure of sensitive information stored in the web cache.

Technologies: Django (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-48587 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48587 being exploited in the wild.
How severe is CVE-2026-48587?: Low severity, with a CVSS score of 3.1, published 3 June 2026.
Which products and versions are affected?: Django (PyPI) ECOSYSTEM:introduced=0,fixed=5.2.15, ECOSYSTEM:introduced=5.2,fixed=5.2.15,introduced=6.0,fixed=6.0.6.
Is there a fix for CVE-2026-48587?: Yes. Django (PyPI): upgrade to 5.2.15, 6.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48587 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48587?: Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Django (PyPI): upgrade to 5.2.15, 6.0.6 or later
```
pip install "Django>=6.0.6"
```

Technical details

A vulnerability exists in django.utils.cache.has_vary_header() where the function fails to strip leading or trailing whitespace from 'Vary' response header values before performing a comparison. This incomplete comparison (CWE-1023) can lead to cache key mismatches or incorrect cache hits. A remote attacker can exploit this to read cached responses by sending requests to URLs where the server-side response includes whitespace-padded Vary headers. The issue is fixed in Django versions 5.2.15 and 6.0.6.

Affected products

Django Software Foundation Django < 5.2.15, >= 6.0.0, < 6.0.6

Identifiers

CVE-2026-48587
GHSA-923m-gv2p-w5qp
PYSEC-2026-198

Timeline

2026-06-03: disclosed
2026-06-03: patched
2026-06-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.