CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. django.middleware.cache.UpdateCacheMiddleware erroneously caches requests where the Vary header contained an asterisk (''). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 6.0.5 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.2.14 - Compensating control
As a mitigation until patched, ensure UpdateCacheMiddleware does not cache responses for requests where the Vary header contains an asterisk ('*'), to avoid private data being stored and served.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6907?
CVE-2026-6907 is considered a high-severity vulnerability due to potential exposure of private data.
How do I fix CVE-2026-6907?
To fix CVE-2026-6907, you should upgrade to Django version 6.0.5 or higher, or 5.2.14 or higher.
What versions of Django are affected by CVE-2026-6907?
CVE-2026-6907 affects Django versions 6.0 up to 6.0.5 and 5.2 up to 5.2.14, as well as multiple earlier 5.0.x, 4.1.x, and 3.2.x versions.
What causes the vulnerability in CVE-2026-6907?
The vulnerability in CVE-2026-6907 is caused by the incorrect caching of requests in UpdateCacheMiddleware when the Vary header contains an asterisk ('*').
What is the potential impact of CVE-2026-6907?
The potential impact of CVE-2026-6907 is the unintended exposure of private data due to erroneous request caching.