IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
4.3Media

CVE-2026-6907Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware

djangoproject Django Publicada: (hace 6 meses)

Descripción

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.

Debilidad (CWE): CWE-524

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
djangoproject Django 6.0 – < 6.0.5, fixed 6.0.5, 5.2 – < 5.2.14, fixed 5.2.14

Referencias y parches

Coincidencias CPE (NVD) (2)
  • cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* ≥ 5.2 < 5.2.14
  • cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* ≥ 6.0 < 6.0.5

CVE recientes del mismo producto — Django

5.3Media
CVE-2026-114582

Server-side request forgery via SpatialReference string input

djangoproject Django

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.gdal.SpatialReference` (and related `transform()` methods and `srs`/`srid` setters) do not restrict GDAL’s file and network access when parsing s…

5.3Media
CVE-2026-111211

Potential log injection via unescaped geometry form values

djangoproject Django

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values befor…