CVE-2026-8404: Django UpdateCacheMiddleware information disclosure via case-sensitive headers

Executive brief

A vulnerability in Django's caching system could allow unauthorized users to view sensitive information that was intended to be private. This occurs because the system fails to correctly recognize certain security instructions if they are written in capital letters, leading it to store and serve data that should not be cached. Organizations using affected versions of Django for web applications may inadvertently expose user-specific or private data to other visitors.

Technical details

A case-sensitivity issue (CWE-178) exists in django.middleware.cache.UpdateCacheMiddleware. The middleware does not match Cache-Control response directives case-insensitively, meaning directives like 'no-store' in mixed or uppercase (e.g., 'No-Store') are ignored. This results in responses being cached when they should have been excluded, allowing remote attackers to potentially access sensitive data from the cache. The vulnerability is fixed in Django versions 5.2.15 and 6.0.6.

Affected products

• Django Software Foundation Django < 5.2.15, >= 6.0.0, < 6.0.6

Timeline

• 2026-06-03: disclosed
• 2026-06-03: advisory
• 2026-06-03: patched

References

• https://api.github.com/users/cgurnik
• https://github.com/cgurnik
• https://api.github.com/users/cgurnik/gists%7B/gist_id%7D
• https://api.github.com/users/cgurnik/repos
• https://avatars.githubusercontent.com/u/720008?v=4
• https://api.github.com/users/cgurnik/events%7B/privacy%7D