Potential exposure of private data via empty and missing Vary headers
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Django versions from 6.1 before 6.1.3, from 6.0 before 6.0.10, and from 5.2 before 5.2.19 are affected. The cache middleware and the cache_page() decorator generate identical cache keys for requests that omit a header listed in the Vary header and requests that send that header with an empty value, which is CWE-524. A remote attacker may access private data cached for another request. The vendor reports that earlier, unsupported Django series were not evaluated and may also be affected.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. The `django.middleware.cache.UpdateCacheMiddleware` and the `django.views.decorators.cache.cache_page()` decorator generate identical cache keys for requests that omit a header listed in the response’s `Vary` header and requests that include that header with an empty value, potentially allowing remote attackers to access private data cached for another request. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew Gonzalez for reporting this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| djangoproject | Django | 6.1 to before 6.1.3; 6.0 to before 6.0.10; 5.2 to before 5.2.19 | 6.1.3, 6.0.10, 5.2.19 | Patch available | CNA |
- Django Vendordjangoproject Affected 6.1 to before 6.1.3; 6.0 to before 6.0.10; 5.2 to before 5.2.19 Fixed in 6.1.3, 6.0.10, 5.2.19 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* | — | — | djangoproject |
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions — — ·djangoproject
Remediation
Upgrade Django to 6.1.3, 6.0.10 or 5.2.19, depending on the series in use.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA Django (djangoproject) Fixed in 6.1.3, 6.0.10, 5.2.19
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
djangoproject Django — Django security releases issued: 6.1.3, 6.0.10, and 5.2.19
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-84393 Server-side request forgery in Django via SpatialReference string inputPriority LOW 37
- TI-2026-84390 Server-side request forgery via crs member of GeoJSON geometriesPriority LOW 37
- TI-2026-84388 Memory exhaustion in Django MultiPartParser via base64 file uploadsPriority LOW 37
Timeline
- 2026-11-03 Threatist record created from CVE-2026-113593
- 2026-11-03 CISA SSVC decision points changed
- 2026-11-03 Alias added: GHSA-rpcg-ffqj-qpjw
References
Patch 4
- https://github.com/django/django/commit/c0b7e5e4e4546e8ddc58262f1945938bb9d9ac2d
- https://github.com/django/django/commit/55e2e009b4f3996e5c55af7b22a8c41eb826e892
- https://github.com/django/django/commit/2006a2b068766bf332f1afcc32b7614d8e5759a2
- https://github.com/django/django/commit/9007fecd3633cfd90b093ebe106af564347c8aee
More djangoproject vulnerabilities
- TI-2022-15177 An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. CVSS 3.1CRITICAL 9.8
- TI-2020-05994 Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection… CVSS 3.1CRITICAL 9.8
- TI-2023-10198 An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0… CVSS 3.1HIGH 7.5
- TI-2019-14306 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. CVSS 3.1CRITICAL 9.8
- TI-2019-10595 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x… CVSS 3.0CRITICAL 9.8
- TI-2021-14006 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-113593 · CVE Program
- CVE-2026-113593 · NVD
- FIRST EPSS
- GHSA-rpcg-ffqj-qpjw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences