EUVD-2026-34088
GHSA-8cjm-8mp7-r2xf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2Blast Radius
ecosystem impact- 12 pypi packages depend on django (12 direct, 0 indirect)
Ecosystem-wide dependent count for version 5.2.
DescriptionCVE.org
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.middleware.cache.UpdateCacheMiddleware in Django does not match Cache-Control response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their Cache-Control directives used uppercase or mixed-case values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmed Badawe for reporting this issue.
AnalysisAI
Incorrect cache storage in Django's UpdateCacheMiddleware exposes responses that should have been excluded from caching due to uppercase or mixed-case Cache-Control directives (e.g., 'Private', 'NO-STORE'). Affected versions 5.2.x before 5.2.15 and 6.0.x before 6.0.6 fail to perform case-insensitive comparison of Cache-Control directive strings, causing the middleware to cache responses it should skip, which remote attackers can then retrieve. No public exploit has been identified at time of analysis, and active exploitation is not confirmed; the low CVSS 4.0 score of 2.3 accurately reflects limited scope, though real-world impact scales with how sensitive the incorrectly cached data is.
Technical ContextAI
CWE-178 (Improper Handling of Case Sensitivity) is the root cause. Per RFC 7234 Section 5.2, Cache-Control directive names are case-insensitive in the HTTP specification, meaning 'Private', 'PRIVATE', and 'private' are semantically equivalent. Django's django.middleware.cache.UpdateCacheMiddleware - the middleware responsible for writing full-page HTTP responses into the cache backend - fails to normalize or case-fold Cache-Control directive strings before comparing them against known exclusion values (e.g., 'private', 'no-store', 'no-cache'). When a response arrives at the middleware bearing a directive like 'Cache-Control: Private' or 'NO-CACHE', the case-sensitive string comparison misses the match, and the middleware treats the response as cacheable. The affected component sits in Django's middleware stack and is opt-in, not enabled by default. No CPE strings were provided in the source intelligence.
RemediationAI
Upgrade to Django 5.2.15 or Django 6.0.6, as released and documented in the official security advisory at https://www.djangoproject.com/weblog/2026/jun/03/security-releases/. Users running unsupported series (5.0.x, 4.1.x, 3.2.x) should upgrade to a current supported release, as those versions were not patched and received no formal security evaluation. If an immediate upgrade is not feasible, a targeted workaround is to audit all application code, custom middleware, and third-party libraries that set Cache-Control headers, ensuring all directive values are emitted in lowercase before reaching UpdateCacheMiddleware. A custom normalization middleware inserted before UpdateCacheMiddleware in MIDDLEWARE could enforce this, though operators should verify it does not conflict with downstream proxy or CDN caching behavior. If UpdateCacheMiddleware is not operationally required, removing it from the middleware stack eliminates the vulnerability entirely at the cost of losing Django's full-page cache functionality.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-178 – Improper Handling of Case Sensitivity
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today