PyPI/django CVE-2026-48588: low 3.1, EPSS 0.43%

Django: cache middleware may expose private responses when unrelated request cookies are present

Action: Upgrade django to 5.2.16 or later.

pip install django==5.2.16

pip install django==6.0.7

Affected

Fixed versions

Sources

• osv: GHSA-3h9f-r86x-qvjx
• https://nvd.nist.gov/vuln/detail/CVE-2026-48588
• https://github.com/django/django/commit/64f9a2b2283fde3ec69fb0dfe441cf0f6f411ba3
• https://github.com/django/django/commit/6e365f8d01f2ba0bbd90968d76a42600fb8bc4b1
• https://github.com/django/django/commit/721685aa7799cc9327bd202cd1f70bd012ca95a7
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2090.yaml
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases

CVE-2026-48588 · published 2026-07-07T15:32:57Z · modified 2026-09-10T03:51:10.140141450Z · JSON