CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.utils.cache.hasvaryheader() in Django does not strip leading or trailing whitespace from Vary response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Navid Rezazadeh for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.2.15 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 6.0.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48587?
The severity of CVE-2026-48587 is classified as low with a score of 3.1.
How do I fix CVE-2026-48587?
To fix CVE-2026-48587, upgrade Django to version 5.2.15 or 6.0.6 or later.
What causes CVE-2026-48587?
CVE-2026-48587 is caused by Django not stripping leading or trailing whitespace from the Vary response header values.
What can attackers do with CVE-2026-48587?
Attackers can exploit CVE-2026-48587 to read cached responses by sending crafted requests that leverage whitespace padding.
Which versions of Django are affected by CVE-2026-48587?
Django versions 5.2 before 5.2.15 and 6.0 before 6.0.6 are affected by CVE-2026-48587.