Vulnerability in Django Middleware and Decorators Affecting Multiple Versions
CVE-2026-113593

2.3LOW

Key Information:

Vendor

Djangoproject

Status
Django
Vendor
CVE Published:
3 November 2026

What is CVE-2026-113593?

A vulnerability in the Django framework affects the UpdateCacheMiddleware and cache_page decorator, resulting in identical cache keys for certain requests. This occurs when requests omit a header listed in the response’s Vary header, or include that header with an empty value, potentially leading to unauthorized access to sensitive data cached from another request. Previous, unsupported versions, such as Django 5.1.x, 5.0.x, and 4.2.x, might also be susceptible, highlighting the importance of evaluating all Django releases for this issue.

Affected Version(s)

Django 6.1 < 6.1.3

Django 6.0 < 6.0.10

Django 5.2 < 5.2.19

References

https://docs.djangoproject.com/en/dev/releases/security/
vendor-advisory
https://groups.google.com/g/django-announce
mailing-list
https://github.com/django/django/commit/c0b7e5e4e4546e8dd...
patch

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrew Gonzalez
Andrew Gonzalez
Jake Howard
Sarah Boyce
Jacob Walls
.