{"id":"DEBIAN-CVE-2026-6907","details":"An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.","modified":"2026-09-01T16:06:58.412923703Z","published":"2026-05-05T16:16:18.227Z","upstream":["CVE-2026-6907"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-6907"}],"affected":[{"package":{"name":"python-django","ecosystem":"Debian:12","purl":"pkg:deb/debian/python-django?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:3.2.19-1","3:3.2.19-1+deb12u1","3:3.2.19-1+deb12u1~bpo11+1","3:3.2.19-1+deb12u2","3:3.2.20-1","3:3.2.20-1.1","3:3.2.21-1","3:3.2.25-0+deb12u1","3:3.2.25-0+deb12u2","3:3.2.25-0+deb12u3","3:3.2.25-0+deb12u4","3:4.1-1","3:4.1.1-1","3:4.1.2-1","3:4.1.3-1","3:4.1.4-1","3:4.1.5-1","3:4.2-1","3:4.2.1-1","3:4.2.10-1","3:4.2.11-1","3:4.2.13-1","3:4.2.14-1","3:4.2.15-1","3:4.2.15-1~bpo12+1","3:4.2.16-1","3:4.2.17-1","3:4.2.17-2","3:4.2.18-1","3:4.2.18-1~bpo12+1","3:4.2.19-1","3:4.2.19-1~bpo12+1","3:4.2.2-1","3:4.2.20-1","3:4.2.20-1~bpo12+1","3:4.2.21-1","3:4.2.21-1~bpo12+1","3:4.2.22-1","3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1","3:4.2.27-1","3:4.2.27-2","3:4.2.28-1","3:4.2.29-1","3:4.2.3-1","3:4.2.30-1","3:4.2.4-1","3:4.2.5-1","3:4.2.5-2","3:4.2.6-1","3:4.2.8-1","3:4.2.9-1","3:4.2~alpha1-1","3:4.2~beta1-1","3:4.2~rc1-1","3:5.0-1","3:5.0.1-1","3:5.0.2-1","3:5.0.3-1","3:5.0.4-1","3:5.0.6-1","3:5.0~alpha1-1","3:5.0~rc1-1","3:5.1-1","3:5.1.1-1","3:5.1.2-1","3:5.1.3-1","3:5.1.4-1","3:5.1.5-1","3:5.1~alpha1-1","3:5.1~beta1-1","3:5.1~rc1-1","3:5.2-1","3:5.2.1-1","3:5.2.13-1","3:5.2.14-1","3:5.2.14-2","3:5.2.15-1","3:5.2.15-2","3:5.2.15-2~bpo13+1","3:5.2.16-1","3:5.2.16-1~bpo13+1","3:5.2.17-1","3:5.2.17-2","3:5.2.2-1","3:5.2.3-1","3:5.2.4-1","3:5.2.5-1","3:5.2.6-1","3:5.2~alpha1-1","3:5.2~beta1-1","3:5.2~rc1-1","3:6.0-1","3:6.0.1-1","3:6.0.2-1","3:6.0.3-1","3:6.0.4-1","3:6.0.5-1","3:6.0.6-1","3:6.0~alpha1-1","3:6.0~beta1-1","3:6.0~rc1-1","3:6.1-1","3:6.1~beta1-1","3:6.1~rc1-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6907.json"}},{"package":{"name":"python-django","ecosystem":"Debian:13","purl":"pkg:deb/debian/python-django?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1","3:4.2.27-0+deb13u1","3:4.2.27-1","3:4.2.27-2","3:4.2.28-0+deb13u1","3:4.2.28-0+deb13u2","3:4.2.28-1","3:4.2.29-1","3:4.2.30-1","3:5.0-1","3:5.0.1-1","3:5.0.2-1","3:5.0.3-1","3:5.0.4-1","3:5.0.6-1","3:5.0~alpha1-1","3:5.0~rc1-1","3:5.1-1","3:5.1.1-1","3:5.1.2-1","3:5.1.3-1","3:5.1.4-1","3:5.1.5-1","3:5.1~alpha1-1","3:5.1~beta1-1","3:5.1~rc1-1","3:5.2-1","3:5.2.1-1","3:5.2.13-1","3:5.2.14-1","3:5.2.14-2","3:5.2.15-1","3:5.2.15-2","3:5.2.15-2~bpo13+1","3:5.2.16-1","3:5.2.16-1~bpo13+1","3:5.2.17-1","3:5.2.17-2","3:5.2.2-1","3:5.2.3-1","3:5.2.4-1","3:5.2.5-1","3:5.2.6-1","3:5.2~alpha1-1","3:5.2~beta1-1","3:5.2~rc1-1","3:6.0-1","3:6.0.1-1","3:6.0.2-1","3:6.0.3-1","3:6.0.4-1","3:6.0.5-1","3:6.0.6-1","3:6.0~alpha1-1","3:6.0~beta1-1","3:6.0~rc1-1","3:6.1-1","3:6.1~beta1-1","3:6.1~rc1-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6907.json"}},{"package":{"name":"python-django","ecosystem":"Debian:14","purl":"pkg:deb/debian/python-django?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.2.14-1"}]}],"versions":["3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1","3:4.2.27-1","3:4.2.27-2","3:4.2.28-1","3:4.2.29-1","3:4.2.30-1","3:5.0-1","3:5.0.1-1","3:5.0.2-1","3:5.0.3-1","3:5.0.4-1","3:5.0.6-1","3:5.0~alpha1-1","3:5.0~rc1-1","3:5.1-1","3:5.1.1-1","3:5.1.2-1","3:5.1.3-1","3:5.1.4-1","3:5.1.5-1","3:5.1~alpha1-1","3:5.1~beta1-1","3:5.1~rc1-1","3:5.2-1","3:5.2.1-1","3:5.2.13-1","3:5.2.2-1","3:5.2.3-1","3:5.2.4-1","3:5.2.5-1","3:5.2.6-1","3:5.2~alpha1-1","3:5.2~beta1-1","3:5.2~rc1-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6907.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}