PT-2026-45949 · Django Software Foundation · Django

Ahmed Badawe + 2 · Published 2026-06-03 · Updated 2026-06-06 · CVE-2026-8404

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Django versions prior to 5.2.15 Django versions prior to 6.0.6

Description An issue exists in django.middleware.cache.UpdateCacheMiddleware where Cache-Control response directives are not matched case-insensitively. This allows remote attackers to read responses that were incorrectly cached due to the use of uppercase or mixed-case values in the Cache-Control directives.

Recommendations Update to version 5.2.15 or newer. Update to version 6.0.6 or newer.

Fix

Weakness Enumeration

CWE-178

Related Identifiers

BIT-DJANGO-2026-8404

CVE-2026-8404

PYSEC-2026-201

Affected Products

Django

References · 8

• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://osv.dev/vulnerability/BIT-django-2026-8404 · Vendor Advisory
• https://djangoproject.com/weblog/2026/jun/03/security-releases · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-201 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8404 · Security Note
• https://groups.google.com/g/django-announce · Note
• https://t.me/CVEtracker/55727 · Telegram Post
• https://twitter.com/oss_security/status/2063112611013480456 · Twitter Post