PyPI/django CVE-2026-48587: low 3.1, EPSS 0.37%

Django: has_vary_header may expose cached responses when Vary values contain whitespace

Action: Upgrade django to 5.2.15 or later.

pip install django==5.2.15

pip install django==6.0.6

Affected

Fixed versions

Sources

• osv: GHSA-923m-gv2p-w5qp
• https://nvd.nist.gov/vuln/detail/CVE-2026-48587
• https://github.com/django/django/commit/1721035a72624aad7b38dd19b14013efd94b24b8
• https://github.com/django/django/commit/42aa0b3364d312e7c6472258d8b0e9c0277fbf22
• https://github.com/django/django/commit/9b62b0af71a14c657d19d95371630ba839e83d9a
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-198.yaml
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jun/03/security-releases

CVE-2026-48587 · published 2026-06-03T15:30:43Z · modified 2026-09-10T03:50:48.942703912Z · JSON