CVE-2026-8404— Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware
Quick assessment
Affected
djangoproject Django
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Django是Django基金会的一套基于Python语言的开源Web应用框架。该框架包括面向对象的映射器、视图系统、模板系统等。 Django 5.2.15之前版本和6.0.6之前版本存在安全漏洞，该漏洞源于UpdateCacheMiddleware未对Cache-Control响应指令进行大小写不敏感匹配，可能导致响应被错误缓存。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| djangoproject | Django | 6.0< 6.0.6 |
affected |
6.0.6 |
unaffected | ||
5.2< 5.2.15 |
affected | ||
5.2.15 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-8404
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
`django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Ahmed Badawe for reporting this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
大小写敏感处理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Django 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Django是Django基金会的一套基于Python语言的开源Web应用框架。该框架包括面向对象的映射器、视图系统、模板系统等。 Django 5.2.15之前版本和6.0.6之前版本存在安全漏洞，该漏洞源于UpdateCacheMiddleware未对Cache-Control响应指令进行大小写不敏感匹配，可能导致响应被错误缓存。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| djangoproject | Django | 6.0 ~ 6.0.6 | - |
|
II. Public POCs for CVE-2026-8404
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-8404
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-8404 (1)
-
Archive of security issues | Django documentation | Django vendor-advisory
Mailing List Discussions for CVE-2026-8404 (1)
-
django-announce - Google Groups mailing-list
Security Blog Posts for CVE-2026-8404 (1)
Same Patch Batch · djangoproject · 2026-06-03 · 7 CVEs total
| CVE-2026-44545 | 5.3 MEDIUM | Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of ser |
| CVE-2026-44546 | 3.7 LOW | Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofi |
| CVE-2026-7666 | 3.1 LOW | Potential unencrypted email transmission via STARTTLS in the SMTP backend |
| CVE-2026-48587 | 3.1 LOW | Potential exposure of private data via whitespace padding in Vary header |
| CVE-2026-35193 | 3.1 LOW | Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddlewar |
| CVE-2026-6873 | 3.1 LOW | Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie |
IV. Related Vulnerabilities
Same product: Django
-
CVE-2026-15920
Potential cross-site scripting via URLField values in the ad -
CVE-2026-15830
Potential denial-of-service vulnerability via nested geometr -
CVE-2026-15337
Potential denial-of-service vulnerability in check_for_langu -
CVE-2026-15307
Server-side file-write and request forgery via spatial looku -
CVE-2026-53878
Header injection possibility since DomainNameValidator accep
Same vendor: djangoproject
-
CVE-2026-15920
Potential cross-site scripting via URLField values in the ad -
CVE-2026-15830
Potential denial-of-service vulnerability via nested geometr -
CVE-2026-15337
Potential denial-of-service vulnerability in check_for_langu -
CVE-2026-15307
Server-side file-write and request forgery via spatial looku -
CVE-2026-53878
Header injection possibility since DomainNameValidator accep
Same weakness: CWE-178
-
CVE-2026-59335
Case-Sensitive Authorization Check Bypass via Identity Zone -
CVE-2026-62673
Grav: .htaccess file extension rules bypass via case variati -
CVE-2026-72836
FileBrowser before 2.63.19 Case Sensitivity Authentication B -
CVE-2026-73416
jupyterlab: PyPI extension blocklist package-name canonicali -
CVE-2026-72721
Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive
V. Comments for CVE-2026-8404
No comments yet