An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Navid Rezazadeh for reporting this issue.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f140cb16b6 advisory.

    Fixes five low-severity CVEs

    - CVE-2026-6873: Signed cookie salt namespace collision
    - CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend
    - CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives
    - CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization
    - CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e4146022ce advisory.

    Fixes five low-severity CVEs

    - CVE-2026-6873: Signed cookie salt namespace collision
    - CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend
    - CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives
    - CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization
    - CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20937-1 advisory.

    Changes in python-Django:

    - CVE-2026-6873: Signed cookie salt namespace collision (bsc#1267578)
    - CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend (bsc#1267579)
    - CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives     (bsc#1267580)
    - CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization (bsc#1267576)
    - CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header (bsc#1267577)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2318-1 advisory.

    This update for python-Django fixes the following issues

    - CVE-2026-6873: signed cookie salt namespace collision in `django.http.HttpRequest.get_signed_cookie`     (bsc#1267578).
    - CVE-2026-7666: potential unencrypted email transmission via `STARTTLS` in the SMTP backend     (bsc#1267579).
    - CVE-2026-8404: potential exposure of private data via case-sensitive `Cache-Control` directives in       `UpdateCacheMiddleware` (bsc#1267580).
    - CVE-2026-35193: potential exposure of private data via missing `Vary: Authorization` in     `UpdateCacheMiddleware`       (bsc#1267576).
    - CVE-2026-48587: potential exposure of private data via whitespace padding in `Vary` header     (bsc#1267577).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The detected version of the Django Python package is 5.2.x prior to 5.2.15 or 6.0.x prior to 6.0.6. It is, therefore, affected by multiple vulnerabilities, including:

  - django.middleware.cache.UpdateCacheMiddleware does not add Authorization to the Vary response header for     requests bearing that header without Cache-Control: public, which allows remote attackers to read private     cached responses via unauthenticated requests to the same URL. (CVE-2026-35193)

  - django.utils.cache.has_vary_header() does not strip leading or trailing whitespace from Vary response     header values before comparison, which allows remote attackers to read cached responses via requests to     URLs whose responses contain whitespace-padded Vary header values. (CVE-2026-48587)

  - django.core.mail.backends.smtp.EmailBackend fails to prevent reuse of a partially-initialized connection     after a failed STARTTLS handshake when fail_silently=True, which allows on-path network attackers to read     email content via cleartext interception. (CVE-2026-7666)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
    `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary`     response header values before comparison, which allows remote attackers to read cached responses via     requests to URLs whose responses contain whitespace-padded Vary header values. Earlier, unsupported Django     series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to     thank Navid Rezazadeh for reporting this issue. (CVE-2026-48587)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321084	Fedora 43 : python-django5 (2026-f140cb16b6)	Nessus	Fedora Local Security Checks	low
321077	Fedora 44 : python-django5 (2026-e4146022ce)	Nessus	Fedora Local Security Checks	low
321071	openSUSE 16 Security Update : python-Django (openSUSE-SU-2026:20937-1)	Nessus	SuSE Local Security Checks	low
321061	SUSE SLES15 Security Update : python-Django (SUSE-SU-2026:2318-1)	Nessus	SuSE Local Security Checks	low
318785	Python Library Django 5.2.x < 5.2.15 / 6.0.x < 6.0.6 Multiple Vulnerabilities	Nessus	Misc.	low
318515	Linux Distros Unpatched Vulnerability : CVE-2026-48587	Nessus	Misc.	low

Detections

Analytics

CVE-2026-48587

low

Tenable Plugins

low

low

low

low

low

low