CVE-2026-8404 Details
Description
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmed Badawe for reporting this issue.
A vulnerability exists in Django's cache middleware that can lead to the improper caching of responses marked as private. This issue is present in Django versions 5.2 prior to 5.2.15 and 6.0 prior to 6.0.6. The problem arises because the `UpdateCacheMiddleware` does not handle `Cache-Control` response directives in a case-insensitive manner. As a result, remote attackers may be able to read responses that were incorrectly cached due to uppercase or mixed-case `Cache-Control` values. While this vulnerability has been identified in the current Django series, earlier unsupported versions may also be affected.
Users can upgrade to Django versions 5.2.15 or 6.0.6 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.djangoproject.com/en/dev/releases/security/ | Django Software Foundation | PatchVendor Advisory |
| https://groups.google.com/g/django-announce | Django Software Foundation | Release Notes |
| https://www.djangoproject.com/weblog/2026/jun/03/security-releases/ | Django Software Foundation | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | Django Software Foundation |
Affected Products
| Product | Versions |
|---|---|
| djangoproject django | >= 5.2, < 5.2.15 >= 6.0, < 6.0.6 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | Django Software Foundation |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | Initial Analysis | [email protected] |
| Jun 3, 2026 | New CVE Received | Django Software Foundation |