CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6907?
CVE-2026-6907 is considered a high-severity vulnerability due to potential exposure of private data.
How do I fix CVE-2026-6907?
To fix CVE-2026-6907, you should upgrade to Django version 6.0.5 or higher, or 5.2.14 or higher.
What versions of Django are affected by CVE-2026-6907?
CVE-2026-6907 affects Django versions 6.0 up to 6.0.5 and 5.2 up to 5.2.14, as well as multiple earlier 5.0.x, 4.1.x, and 3.2.x versions.
What causes the vulnerability in CVE-2026-6907?
The vulnerability in CVE-2026-6907 is caused by the incorrect caching of requests in UpdateCacheMiddleware when the Vary header contains an asterisk ('*').
What is the potential impact of CVE-2026-6907?
The potential impact of CVE-2026-6907 is the unintended exposure of private data due to erroneous request caching.