{"id":"CVE-2026-8404","aliases":["GHSA-8cjm-8mp7-r2xf","BIT-django-2026-8404","PYSEC-2026-201"],"title":"Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling","summary":"Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","vendor":"django","product":"django","ecosystem":"pip","affected":["django < 5.2.15","django >= 6.0.0, < 6.0.6"],"patched":["django 5.2.15","django 6.0.6"],"published":"2026-06-03","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:48.806230224Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-8cjm-8mp7-r2xf","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8404"},{"url":"https://github.com/django/django/commit/366d9ae6e8d1469c04e9ebdc1bcd098fc14a3b1e"},{"url":"https://github.com/django/django/commit/b4330259ffbe1a031ed14daab1f35697460f10f2"},{"url":"https://github.com/django/django/commit/d618d7ae4fec727d5b582bd24f803c28d17bf7cd"},{"url":"https://docs.djangoproject.com/en/dev/releases/security"},{"url":"https://github.com/django/django"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-201.yaml"},{"url":"https://groups.google.com/g/django-announce"},{"url":"https://www.djangoproject.com/weblog/2026/jun/03/security-releases"}],"tags":["osv","pip"],"epss":0.00285,"epssPercentile":0.21181,"ingestedAt":"2026-08-08T19:14:54.095Z","slug":"CVE-2026-8404","body":"## Overview\n\nAn issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.\n`django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ahmed Badawe for reporting this issue.\n\n## Affected packages\n\n- `django < 5.2.15`\n- `django >= 6.0.0, < 6.0.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `django 5.2.15`\n- `django 6.0.6`","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}