Low severity3.1NVD Advisory· Published Jul 7, 2026· Updated Jul 9, 2026
CVE-2026-48588
CVE-2026-48588
Description
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cache_page() decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
djangoPyPI | < 5.2.16 | 5.2.16 |
djangoPyPI | >= 6.0.0, < 6.0.7 | 6.0.7 |
Affected products
14- Range: <6.0.7, <5.2.16
- osv-coords12 versionspkg:apk/chainguard/authentik-2026.2pkg:apk/chainguard/authentik-2026.5pkg:apk/chainguard/authentik-fips-2026.2pkg:apk/chainguard/authentik-fips-2026.5pkg:apk/chainguard/openstack-horizon-2026.1pkg:apk/chainguard/openstack-horizon-2026.1-fipspkg:bitnami/djangopkg:rpm/opensuse/python-Django&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-Django&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/python-Django4&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/python-Django5&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/python-Django6&distro=openSUSE%20Tumbleweed
< 2026.2.6-r14+ 11 more
- (no CPE)range: < 2026.2.6-r14
- (no CPE)range: < 2026.5.6-r6
- (no CPE)range: < 2026.2.6-r14
- (no CPE)range: < 2026.5.6-r8
- (no CPE)range: < 25.7.3_git20260806-r1
- (no CPE)range: < 25.7.3_git20260806-r1
- (no CPE)range: >= 5.2.0, < 5.2.16
- (no CPE)range: < 5.2.4-bp160.10.1
- (no CPE)range: < 5.2.16-1.1
- (no CPE)range: < 4.2.30-4.1
- (no CPE)range: < 5.2.16-1.1
- (no CPE)range: < 6.0.7-1.1
Patches
Vulnerability mechanics
References
11- docs.djangoproject.com/en/dev/releases/security/nvdPatchVendor Advisory
- github.com/advisories/GHSA-3h9f-r86x-qvjxghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-48588ghsaADVISORY
- www.djangoproject.com/weblog/2026/jul/07/security-releases/nvdVendor AdvisoryPatch
- docs.djangoproject.com/en/dev/releases/securityghsaWEB
- github.com/django/django/commit/64f9a2b2283fde3ec69fb0dfe441cf0f6f411ba3ghsaWEB
- github.com/django/django/commit/6e365f8d01f2ba0bbd90968d76a42600fb8bc4b1ghsaWEB
- github.com/django/django/commit/721685aa7799cc9327bd202cd1f70bd012ca95a7ghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2090.yamlghsaWEB
- groups.google.com/g/django-announcenvdRelease NotesWEB
- www.djangoproject.com/weblog/2026/jul/07/security-releasesghsaWEB
News mentions
0No linked articles in our index yet.