PT-2026-45944 · Django+1 · Django+1

Jake Howard + 2 · CVE-2026-48587 · Published 2026-06-03 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Django versions prior to 5.2.15 Django versions prior to 6.0.6

Description The django.utils.cache.has vary header() function does not strip leading or trailing whitespace from Vary response header values before comparison. This allows remote attackers to read cached responses by making requests to URLs that have whitespace-padded Vary header values.

Recommendations Update to version 5.2.15 or newer. Update to version 6.0.6 or newer.

Exploit

Fix

Weakness Enumeration

CWE-524

CWE-1023

Related Identifiers

BDU:2026-10478

BIT-DJANGO-2026-48587

CVE-2026-48587

OESA-2026-2659

OESA-2026-2660

OESA-2026-2661

OPENSUSE-SU-2026:10989-1

OPENSUSE-SU-2026:11002-1

OPENSUSE-SU-2026:11003-1

OPENSUSE-SU-2026:11270-1

OPENSUSE-SU-2026:20937-1

PYSEC-2026-198

SUSE-SU-2026:2318-1

Affected Products

Django

Red Os

References · 138

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48587.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6873 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:11002-1 · Vendor Advisory
• https://djangoproject.com/weblog/2026/jun/03/security-releases · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-48587 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-48587 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-198 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11270-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-10478 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:11003-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35193 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-48587 · Security Note
• https://osv.dev/vulnerability/CVE-2026-48587 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-django-2026-48587 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8404 · Security Note