An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Navid Rezazadeh for reporting this issue.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099501 advisory.

    An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
    `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary`     response header values before comparison, which allows remote attackers to read cached responses via     requests to URLs whose responses contain whitespace-padded Vary header values.
    Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be     affected.
    Django would like to thank Navid Rezazadeh for reporting this issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f140cb16b6 advisory.

    Fixes five low-severity CVEs

    - CVE-2026-6873: Signed cookie salt namespace collision
    - CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend
    - CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives
    - CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization
    - CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e4146022ce advisory.

    Fixes five low-severity CVEs

    - CVE-2026-6873: Signed cookie salt namespace collision
    - CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend
    - CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives
    - CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization
    - CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20937-1 advisory.

    Changes in python-Django:

    - CVE-2026-6873: Signed cookie salt namespace collision (bsc#1267578)
    - CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend (bsc#1267579)
    - CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives     (bsc#1267580)
    - CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization (bsc#1267576)
    - CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header (bsc#1267577)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2318-1 advisory.

    This update for python-Django fixes the following issues

    - CVE-2026-6873: signed cookie salt namespace collision in `django.http.HttpRequest.get_signed_cookie`     (bsc#1267578).
    - CVE-2026-7666: potential unencrypted email transmission via `STARTTLS` in the SMTP backend     (bsc#1267579).
    - CVE-2026-8404: potential exposure of private data via case-sensitive `Cache-Control` directives in       `UpdateCacheMiddleware` (bsc#1267580).
    - CVE-2026-35193: potential exposure of private data via missing `Vary: Authorization` in     `UpdateCacheMiddleware`       (bsc#1267576).
    - CVE-2026-48587: potential exposure of private data via whitespace padding in `Vary` header     (bsc#1267577).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
    `django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating
    the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different
    from the one where it was signed, via distinct `(name, salt)` pairs that produce the same concatenation.
    Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be
    affected. Django would like to thank Peng Zhou for reporting this issue. (CVE-2026-6873)

  - An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
    `django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized
    connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network
    attackers to read email content via cleartext interception. Earlier, unsupported Django series (such as
    5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kasper
    Dupont for reporting this issue. (CVE-2026-7666)

  - An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
    `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response
    directives case-insensitively, which allows remote attackers to read responses that were incorrectly
    cached because their `Cache-Control` directives used uppercase or mixed-case values. Earlier, unsupported
    Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would
    like to thank Ahmed Badawe for reporting this issue. (CVE-2026-8404)

  - An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
    `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary`
    response header for requests bearing that header without `Cache-Control: public`, which allows remote
    attackers to read private cached responses via unauthenticated requests to the same URL. Earlier,
    unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
    Django would like to thank Shai Berger for reporting this issue. (CVE-2026-35193)

  - An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
    `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary`
    response header values before comparison, which allows remote attackers to read cached responses via
    requests to URLs whose responses contain whitespace-padded Vary header values. Earlier, unsupported Django
    series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to
    thank Navid Rezazadeh for reporting this issue. (CVE-2026-48587)

The detected version of the Django Python package is 5.2.x prior to 5.2.15 or 6.0.x prior to 6.0.6. It is, therefore, affected by multiple vulnerabilities, including:

  - django.middleware.cache.UpdateCacheMiddleware does not add Authorization to the Vary response header for     requests bearing that header without Cache-Control: public, which allows remote attackers to read private     cached responses via unauthenticated requests to the same URL. (CVE-2026-35193)

  - django.utils.cache.has_vary_header() does not strip leading or trailing whitespace from Vary response     header values before comparison, which allows remote attackers to read cached responses via requests to     URLs whose responses contain whitespace-padded Vary header values. (CVE-2026-48587)

  - django.core.mail.backends.smtp.EmailBackend fails to prevent reuse of a partially-initialized connection     after a failed STARTTLS handshake when fail_silently=True, which allows on-path network attackers to read     email content via cleartext interception. (CVE-2026-7666)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
    `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary`     response header values before comparison, which allows remote attackers to read cached responses via     requests to URLs whose responses contain whitespace-padded Vary header values. Earlier, unsupported Django     series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to     thank Navid Rezazadeh for reporting this issue. (CVE-2026-48587)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
336843	Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099501)	Nessus	Unity Linux Local Security Checks	Local	low
321084	Fedora 43 : python-django5 (2026-f140cb16b6)	Nessus	Fedora Local Security Checks	Local	low
321077	Fedora 44 : python-django5 (2026-e4146022ce)	Nessus	Fedora Local Security Checks	Local	low
321071	openSUSE 16 Security Update : python-Django (openSUSE-SU-2026:20937-1)	Nessus	SuSE Local Security Checks	Local	low
321061	SUSE SLES15 Security Update : python-Django (SUSE-SU-2026:2318-1)	Nessus	SuSE Local Security Checks	Local	low
443094	Alpine: multiple py3-django packages: security update to 5.2.15-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	low
443094	Alpine: multiple py3-django packages: security update to 5.2.15-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	low
318785	Python Library Django 5.2.x < 5.2.15 / 6.0.x < 6.0.6 Multiple Vulnerabilities	Nessus	Misc.	Local	low
318515	Linux Distros Unpatched Vulnerability : CVE-2026-48587	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-48587

low

Tenable Plugins

low

low

low

low

low

low

low

low

low