# CVE-2026-48587: Django information disclosure via whitespace padding in Vary header

Source: https://junglewise.ai/threats/cve-2026-48587-django-information-disclosure-via-whitespace-padding-in-vary  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-08-07  
License: CC BY 4.0 with a link back

CVE-2026-48587 · Severity: low · CVSS 3.1 · Published 2026-06-03

Django is a popular web framework used to build and manage websites. A flaw in how it handles certain web headers could allow an attacker to view cached data that they should not have access to. This occurs when specific technical settings (Vary headers) contain extra spaces, potentially leading to the exposure of sensitive information stored in the web cache.

Technologies: [Django (PyPI)](https://junglewise.ai/threats/technologies/django). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-48587 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48587 being exploited in the wild.

**How severe is CVE-2026-48587?** Low severity, with a CVSS score of 3.1, published 3 June 2026.

**Which products and versions are affected?** Django (PyPI) ECOSYSTEM:introduced=0,fixed=5.2.15, ECOSYSTEM:introduced=5.2,fixed=5.2.15,introduced=6.0,fixed=6.0.6.

**Is there a fix for CVE-2026-48587?** Yes. Django (PyPI): upgrade to 5.2.15, 6.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48587 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48587?** Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Django (PyPI): upgrade to 5.2.15, 6.0.6 or later

  ```sh
  pip install "Django>=6.0.6"
  ```


## Technical details

A vulnerability exists in django.utils.cache.has_vary_header() where the function fails to strip leading or trailing whitespace from 'Vary' response header values before performing a comparison. This incomplete comparison (CWE-1023) can lead to cache key mismatches or incorrect cache hits. A remote attacker can exploit this to read cached responses by sending requests to URLs where the server-side response includes whitespace-padded Vary headers. The issue is fixed in Django versions 5.2.15 and 6.0.6.

## Affected products

- Django Software Foundation Django < 5.2.15, >= 6.0.0, < 6.0.6

## Identifiers

- CVE-2026-48587
- GHSA-923m-gv2p-w5qp
- PYSEC-2026-198

## Timeline

- 2026-06-03: disclosed
- 2026-06-03: patched
- 2026-06-03: advisory

## References

- [https://api.github.com/users/cgurnik](https://api.github.com/users/cgurnik)
- [https://github.com/cgurnik](https://github.com/cgurnik)
- [https://api.github.com/users/cgurnik/gists%7B/gist_id%7D](https://api.github.com/users/cgurnik/gists%7B/gist_id%7D)
- [https://api.github.com/users/cgurnik/repos](https://api.github.com/users/cgurnik/repos)
- [https://avatars.githubusercontent.com/u/720008?v=4](https://avatars.githubusercontent.com/u/720008?v=4)
- [https://api.github.com/users/cgurnik/events%7B/privacy%7D](https://api.github.com/users/cgurnik/events%7B/privacy%7D)

## Related threats

- [Django GeoDjango unbounded recursion denial of service](https://junglewise.ai/threats/cve-2026-15830-django-geodjango-unbounded-recursion-denial-of-service)
- [Django GeoDjango spatial lookups file write and request forgery](https://junglewise.ai/threats/cve-2026-15307-django-geodjango-spatial-lookups-file-write-and-request-forgery)
- [PYSEC-2026-2449 - Django has a Race Condition vulnerability](https://junglewise.ai/threats/cve-2026-25674-django-has-a-race-condition-vulnerability)
- [PYSEC-2026-1296 - Django vulnerable to partial directory traversal via archives](https://junglewise.ai/threats/cve-2025-59682-django-vulnerable-to-partial-directory-traversal-via-archives)
- [Django DomainNameValidator header injection via newline characters](https://junglewise.ai/threats/cve-2026-53878-django-domainnamevalidator-header-injection-via-newline)