Bug 2564004 (CVE-2026-113593)

Summary:	CVE-2026-113593 django: Potential exposure of private data via empty and missing `Vary` headers
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	anthomas, brasmith, cmyers, cochase, dnakabaa, dranck, dschmidt, eglynn, ehelms, ggainey, jjoyce, jlanda, jmitchel, jpasqual, jpretori, jschluet, juwatts, jwong, kaycoth, kshier, lblicha, lbrazdil, lcouzens, lhh, mburns, mdellweg, mgarciac, mhulan, mminar, nmoumoul, ogajduse, omaciel, osousa, pcreech, rbiba, rbobbitt, rchan, security-response-team, simaishi, smallamp, sskracic, stcannon, tguha, tmalecek, tpfromme, ttakamiy, yguenane, zhunting
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Django. This vulnerability leads to information disclosure due to improper cache key generation when handling HTTP headers. The caching mechanism treats web requests that omit a specified header identically to requests that supply the header with an empty value. As a result, a remote attacker could receive cached responses intended for other requests, potentially exposing private data.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-30 13:26:28 UTC

CVE-2026-113593: Potential exposure of private data via empty and missing `Vary` headers

`UpdateCacheMiddleware` and `cache_page()` generated the same cache key

for a request that omitted a header listed in the response's `Vary` header
and a request that sent that header with an empty value. As a result, a
response cached for one of these requests could be served to the other, which
could lead to the exposure of private data.

Cache keys now distinguish between absent and empty header values, as required
by [RFC 9111#section-4.1](https://datatracker.ietf.org/doc/html/rfc9111.html#section-4.1).

Responses previously cached for requests that omitted a header listed in
`Vary` will no longer be matched, and will be cached again on the next
request.

This issue has severity "low" according to the [Django security policy](https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels).

Thanks to Andrew Gonzalez for the report.