CVE-2026-48587

score

<0.1

cvss

3.1

epss

0.4%

published

2026-06-03

kev added

—

first seen

2026-10-21

Django < 5.2.15 and < 6.0.6 contain an information disclosure vulnerability caused by improper handling of whitespace in Vary response headers in django.utils.cache.has_vary_header(), letting remote attackers read cached responses via whitespace-padded Vary headers, exploit requires crafted requests.