{"action":"Upgrade django to 5.2.15 or later.","affected":[{"fixed":"5.2.15","introduced":"5.2.0"},{"fixed":"6.0.6","introduced":"6.0.0"}],"component":"django","cve_ids":["CVE-2026-35193"],"ecosystem":"PyPI","epss":0.00372,"exploited":false,"fixed_versions":["5.2.15","6.0.6"],"ghsa_id":"GHSA-qpc8-7fxc-cm4p","id":"tcs_01M5KFWE26QZR9CW4EG9ZMQM5F","modified_at":"2026-08-07T20:11:00.278926038Z","published_at":"2026-06-03T15:30:42Z","references":["https://osv.dev/vulnerability/GHSA-qpc8-7fxc-cm4p","https://nvd.nist.gov/vuln/detail/CVE-2026-35193","https://github.com/django/django/commit/050a3dc276f9142067260e990e4d8d42d5e32863","https://github.com/django/django/commit/664652f1a2dd80d8a4cd491b4313cad915ae6669","https://github.com/django/django/commit/a2faa8e895926ac5d63f72879b5ccf671b5b4ba9","https://docs.djangoproject.com/en/dev/releases/security","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-197.yaml","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2026/jun/03/security-releases"],"severity":{"label":"low","score":3.1},"sources":[{"source":"osv","source_id":"GHSA-qpc8-7fxc-cm4p","url":"https://osv.dev/vulnerability/GHSA-qpc8-7fxc-cm4p"}],"summary":"Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary"}