Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-06-03T13:16:47 django: Django: Information disclosure via improper handling of Vary header whitespace 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CWE-524

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Navid Rezazadeh for reporting this issue.

A flaw was found in Django. Remote attackers can exploit this vulnerability due to `django.utils.cache.has_vary_header()` not properly stripping whitespace from `Vary` response header values. This allows an attacker to read cached responses by sending requests to URLs with whitespace-padded `Vary` header values, leading to information disclosure.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-24/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-25/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/gateway-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/hub-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/aap-cloud-billing-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/gateway-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/hub-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/metrics-service-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform/automation-dashboard-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-tech-preview/metrics-service-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred automation-controller Red Hat Discovery 2 Fix deferred discovery/discovery-server-rhel9 Red Hat Satellite 6 Fix deferred satellite/iop-advisor-backend-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-48587 https://nvd.nist.gov/vuln/detail/CVE-2026-48587 https://docs.djangoproject.com/en/dev/releases/security/ https://groups.google.com/g/django-announce https://www.djangoproject.com/weblog/2026/jun/03/security-releases/