---
id: CVE-2024-25142
aliases:
  - GHSA-9xpj-62mm-24h2
  - BIT-airflow-2024-25142
  - PYSEC-2024-195
title: Apache Airflow does not return the "Cache-Control" header for dynamic content
summary: Apache Airflow does not return the "Cache-Control" header for dynamic content
severity: low
vendor: apache-airflow
product: apache-airflow
ecosystem: pip
affected:
  - apache-airflow < 2.9.2
patched:
  - apache-airflow 2.9.2
published: '2024-06-14'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:15.152046625Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-9xpj-62mm-24h2'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-25142'
  - url: 'https://github.com/apache/airflow/pull/39550'
  - url: >-
      https://github.com/apache/airflow/commit/94eb647de692a4d9555b02dce85974da5d4c04e3
  - url: 'https://github.com/apache/airflow'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-195.yaml
  - url: 'https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr'
  - url: 'http://www.openwall.com/lists/oss-security/2024/06/13/1'
tags:
  - osv
  - pip
epss: 0.00321
epssPercentile: 0.22463
ingestedAt: '2026-09-12T03:13:01.685Z'
---

## Overview

Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. 

Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser.

This issue affects Apache Airflow: before 2.9.2.

Users are recommended to upgrade to version 2.9.2, which fixes the issue.



## Affected packages

- `apache-airflow < 2.9.2`

## Remediation

Upgrade to a patched release:

- `apache-airflow 2.9.2`