An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmed Badawe for reporting this issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
    `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response
    directives case-insensitively, which allows remote attackers to read responses that were incorrectly
    cached because their `Cache-Control` directives used uppercase or mixed-case values. Earlier, unsupported
    Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would
    like to thank Ahmed Badawe for reporting this issue. (CVE-2026-8404)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8848-1 advisory.

    Bence Nagy discovered that GeoDjango in Django incorrectly handled spatial lookups when processing     untrusted input. A remote attacker could possibly use this issue to make outbound network requests, write     arbitrary files, or execute arbitrary code. This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu     24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-15307)

    Ahmad Sadeddin discovered that Django UpdateCacheMiddleware incorrectly cached requests where the Vary     header contained an asterisk. A remote attacker could possibly use this issue to obtain sensitive     information. (CVE-2026-6907)

    Ahmed Badawe discovered that Django did not properly parse Cache-Control response directives case-     insensitively under certain circumstances. A remote attacker could possibly use this issue to view     sensitive information from responses that were incorrectly cached. This issue only affected

    Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-8404)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099482 advisory.

    An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
    `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response     directives case-insensitively, which allows remote attackers to read responses that were incorrectly     cached because their `Cache-Control` directives used uppercase or mixed-case values.
    Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be     affected.
    Django would like to thank Ahmed Badawe for reporting this issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f140cb16b6 advisory.

    Fixes five low-severity CVEs

    - CVE-2026-6873: Signed cookie salt namespace collision
    - CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend
    - CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives
    - CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization
    - CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e4146022ce advisory.

    Fixes five low-severity CVEs

    - CVE-2026-6873: Signed cookie salt namespace collision
    - CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend
    - CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives
    - CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization
    - CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20937-1 advisory.

    Changes in python-Django:

    - CVE-2026-6873: Signed cookie salt namespace collision (bsc#1267578)
    - CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend (bsc#1267579)
    - CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives     (bsc#1267580)
    - CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization (bsc#1267576)
    - CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header (bsc#1267577)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2318-1 advisory.

    This update for python-Django fixes the following issues

    - CVE-2026-6873: signed cookie salt namespace collision in `django.http.HttpRequest.get_signed_cookie`     (bsc#1267578).
    - CVE-2026-7666: potential unencrypted email transmission via `STARTTLS` in the SMTP backend     (bsc#1267579).
    - CVE-2026-8404: potential exposure of private data via case-sensitive `Cache-Control` directives in       `UpdateCacheMiddleware` (bsc#1267580).
    - CVE-2026-35193: potential exposure of private data via missing `Vary: Authorization` in     `UpdateCacheMiddleware`       (bsc#1267576).
    - CVE-2026-48587: potential exposure of private data via whitespace padding in `Vary` header     (bsc#1267577).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
    `django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating
    the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different
    from the one where it was signed, via distinct `(name, salt)` pairs that produce the same concatenation.
    Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be
    affected. Django would like to thank Peng Zhou for reporting this issue. (CVE-2026-6873)

  - An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
    `django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized
    connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network
    attackers to read email content via cleartext interception. Earlier, unsupported Django series (such as
    5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kasper
    Dupont for reporting this issue. (CVE-2026-7666)

  - An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
    `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response
    directives case-insensitively, which allows remote attackers to read responses that were incorrectly
    cached because their `Cache-Control` directives used uppercase or mixed-case values. Earlier, unsupported
    Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would
    like to thank Ahmed Badawe for reporting this issue. (CVE-2026-8404)

  - An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
    `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary`
    response header for requests bearing that header without `Cache-Control: public`, which allows remote
    attackers to read private cached responses via unauthenticated requests to the same URL. Earlier,
    unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
    Django would like to thank Shai Berger for reporting this issue. (CVE-2026-35193)

  - An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
    `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary`
    response header values before comparison, which allows remote attackers to read cached responses via
    requests to URLs whose responses contain whitespace-padded Vary header values. Earlier, unsupported Django
    series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to
    thank Navid Rezazadeh for reporting this issue. (CVE-2026-48587)

The detected version of the Django Python package is 5.2.x prior to 5.2.15 or 6.0.x prior to 6.0.6. It is, therefore, affected by multiple vulnerabilities, including:

  - django.middleware.cache.UpdateCacheMiddleware does not add Authorization to the Vary response header for     requests bearing that header without Cache-Control: public, which allows remote attackers to read private     cached responses via unauthenticated requests to the same URL. (CVE-2026-35193)

  - django.utils.cache.has_vary_header() does not strip leading or trailing whitespace from Vary response     header values before comparison, which allows remote attackers to read cached responses via requests to     URLs whose responses contain whitespace-padded Vary header values. (CVE-2026-48587)

  - django.core.mail.backends.smtp.EmailBackend fails to prevent reuse of a partially-initialized connection     after a failed STARTTLS handshake when fail_silently=True, which allows on-path network attackers to read     email content via cleartext interception. (CVE-2026-7666)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
    `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response     directives case-insensitively, which allows remote attackers to read responses that were incorrectly     cached because their `Cache-Control` directives used uppercase or mixed-case values. Earlier, unsupported     Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would     like to thank Ahmed Badawe for reporting this issue. (CVE-2026-8404)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
458170	Echo: django: security update to 6.0.6	Tenable Cloud Security	Echo Local Security Checks	Local	low
458170	Echo: django: security update to 6.0.6	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
362565	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Django vulnerabilities (USN-8848-1)	Nessus	Ubuntu Local Security Checks	Local	high
336960	Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099482)	Nessus	Unity Linux Local Security Checks	Local	low
321084	Fedora 43 : python-django5 (2026-f140cb16b6)	Nessus	Fedora Local Security Checks	Local	low
321077	Fedora 44 : python-django5 (2026-e4146022ce)	Nessus	Fedora Local Security Checks	Local	low
321071	openSUSE 16 Security Update : python-Django (openSUSE-SU-2026:20937-1)	Nessus	SuSE Local Security Checks	Local	low
321061	SUSE SLES15 Security Update : python-Django (SUSE-SU-2026:2318-1)	Nessus	SuSE Local Security Checks	Local	low
443094	Alpine: multiple py3-django packages: security update to 5.2.15-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	low
443094	Alpine: multiple py3-django packages: security update to 5.2.15-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	low
318785	Python Library Django 5.2.x < 5.2.15 / 6.0.x < 6.0.6 Multiple Vulnerabilities	Nessus	Misc.	Local	low
318468	Linux Distros Unpatched Vulnerability : CVE-2026-8404	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-8404

low

Tenable Plugins

low

low

high

low

low

low

low

low

low

low

low

low