CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.middleware.cache.UpdateCacheMiddleware in Django does not match Cache-Control response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their Cache-Control directives used uppercase or mixed-case values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmed Badawe for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.2.15 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 6.0.6 - Compensating control
Mitigate the issue by ensuring that any Cache-Control directives used in responses (for paths protected by UpdateCacheMiddleware) are written in consistent case (e.g., lowercase) so UpdateCacheMiddleware matches them correctly case-insensitively.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8404?
The severity of CVE-2026-8404 is classified as low with a score of 3.1.
How do I fix CVE-2026-8404?
To fix CVE-2026-8404, upgrade Django to version 5.2.15 or 6.0.6 or later.
What is the main issue described in CVE-2026-8404?
The main issue in CVE-2026-8404 is the incorrect case sensitivity in matching Cache-Control response directives, which may expose private data.
Which versions of Django are affected by CVE-2026-8404?
CVE-2026-8404 affects Django versions prior to 5.2.15 and 6.0 before 6.0.6.
What type of attack does CVE-2026-8404 facilitate?
CVE-2026-8404 facilitates remote attackers to potentially read erroneously cached responses due to improper Cache-Control header handling.