PkgSeer

Vulnerability GHSA-3h9f-r86x-qvjx

Low Risk

2 months ago

Django: cache middleware may expose private responses when unrelated request cookies are present

1.0.1 - 5.2.15 and 6.0 - 6.0.6

Summary

Django: cache middleware may expose private responses when unrelated request cookies are present

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cache_page() decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Django GeoDjango vulnerable to denial of service through deeply nested geometry collections

1.0.1 - 5.2.16 and 6.0a1 - 6.0.7 and 6.1a1 - 6.1 GHSA-q238-5cxm-5c9h

Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

1.0.1 - 5.2.16 and 6.0a1 - 6.0.7 GHSA-wvqv-fj8w-qmhm

No summary available

1.0.1 - 5.2.16 and 6.0 - 6.0.7 PYSEC-2026-3717

Django vulnerable to Uncontrolled Resource Consumption

4.2 - 4.2.28 and 5.2 - 5.2.11 and 6.0 - 6.0.2 PYSEC-2026-2448

Django has a Race Condition vulnerability

4.2 - 4.2.28 and 5.2 - 5.2.11 and 6.0 - 6.0.2 PYSEC-2026-2449

View all vulnerabilities for these packages

Impacted packages

django

Timeline

Published

2 months ago

Fixed (6.0.7)

2 months ago

Fixed (5.2.16)

2 months ago

Last Modified

20 days ago