GHSA-3H9F-R86X-QVJX Django: cache middleware may expose private responses when unrelated request cookies are present

🗓️ 07 Jul 2026 15:32:57Reported by GoogleType

osv

osv🔗 osv.dev👁 6 Views

Django cache may expose private responses when unrelated cookies exist.

Reporter	Title	Published	Views	Family All 47
ATTACKERKB	CVE-2026-48588	7 Jul 202614:09	–	attackerkb
AlpineLinux	CVE-2026-48588	7 Jul 202614:09	–	alpinelinux
Chainguard	CVE-2026-48588 vulnerabilities	10 Aug 202620:30	–	cgr
Circl	CVE-2026-48588	7 Jul 202615:02	–	circl
CVE	CVE-2026-48588	7 Jul 202614:09	–	cve
Cvelist	CVE-2026-48588 Potential exposure of private data via cached Set-Cookie response	7 Jul 202614:09	–	cvelist
Debian CVE	CVE-2026-48588	7 Jul 202614:09	–	debiancve
EUVD	EUVD-2026-42043	7 Jul 202614:09	–	euvd
Fedora	[SECURITY] Fedora 43 Update: python-django5-5.2.16-1.fc43	25 Jul 202601:18	–	fedora
Fedora	[SECURITY] Fedora 44 Update: python-django5-5.2.16-1.fc44	18 Jul 202600:28	–	fedora

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-48588
github	www.github.com/django/django/commit/64f9a2b2283fde3ec69fb0dfe441cf0f6f411ba3
github	www.github.com/django/django/commit/6e365f8d01f2ba0bbd90968d76a42600fb8bc4b1
github	www.github.com/django/django/commit/721685aa7799cc9327bd202cd1f70bd012ca95a7
docs	www.docs.djangoproject.com/en/dev/releases/security
github	www.github.com/django/django
github	www.github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2090.yaml
groups	www.groups.google.com/g/django-announce
djangoproject	www.djangoproject.com/weblog/2026/jul/07/security-releases

10 Aug 2026 15:39Current

6.4Medium risk

Vulners AI Score6.4

CVSS 42.3

CVSS 3.13.1

EPSS0.00361

unrelated cookies cache exposure private data update cache middleware django security