---
id: CVE-2026-8404
aliases:
  - GHSA-8cjm-8mp7-r2xf
  - BIT-django-2026-8404
  - PYSEC-2026-201
title: >-
  Django: UpdateCacheMiddleware may disclose cached responses due to
  case-sensitive Cache-Control handling
summary: >-
  Django: UpdateCacheMiddleware may disclose cached responses due to
  case-sensitive Cache-Control handling
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N'
vendor: django
product: django
ecosystem: pip
affected:
  - django < 5.2.15
  - 'django >= 6.0.0, < 6.0.6'
patched:
  - django 5.2.15
  - django 6.0.6
published: '2026-06-03'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:48.806230224Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-8cjm-8mp7-r2xf'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8404'
  - url: >-
      https://github.com/django/django/commit/366d9ae6e8d1469c04e9ebdc1bcd098fc14a3b1e
  - url: >-
      https://github.com/django/django/commit/b4330259ffbe1a031ed14daab1f35697460f10f2
  - url: >-
      https://github.com/django/django/commit/d618d7ae4fec727d5b582bd24f803c28d17bf7cd
  - url: 'https://docs.djangoproject.com/en/dev/releases/security'
  - url: 'https://github.com/django/django'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-201.yaml
  - url: 'https://groups.google.com/g/django-announce'
  - url: 'https://www.djangoproject.com/weblog/2026/jun/03/security-releases'
tags:
  - osv
  - pip
epss: 0.00285
epssPercentile: 0.21236
ingestedAt: '2026-08-08T19:14:54.095Z'
---

## Overview

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
`django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Ahmed Badawe for reporting this issue.

## Affected packages

- `django < 5.2.15`
- `django >= 6.0.0, < 6.0.6`

## Remediation

Upgrade to a patched release:

- `django 5.2.15`
- `django 6.0.6`