CVE-2026-113593 (GCVE-0-2026-113593)

Vulnerability from cvelistv5 – Published: 2026-11-03 15:42 – Updated: 2026-11-03 18:26
VLAI
Title
Potential exposure of private data via empty and missing Vary headers
Summary
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. The `django.middleware.cache.UpdateCacheMiddleware` and the `django.views.decorators.cache.cache_page()` decorator generate identical cache keys for requests that omit a header listed in the response’s `Vary` header and requests that include that header with an empty value, potentially allowing remote attackers to access private data cached for another request. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew Gonzalez for reporting this issue.
Severity
3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:19 UTC
CWE
  • CWE-524 - Use of Cache Containing Sensitive Information
Assigner
DSF CNA under the mitre root
CNA scorecard B 86/100 over 24 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
djangoproject Django Affected: 6.1 , < 6.1.3 (python)
Unaffected: 6.1.3 (python)
Affected: 6.0 , < 6.0.10 (python)
Unaffected: 6.0.10 (python)
Affected: 5.2 , < 5.2.19 (python)
Unaffected: 5.2.19 (python)
guessed Create a notification for this product.
Date Public
2026-11-03 09:30
Credits
Andrew Gonzalez Andrew Gonzalez Jake Howard Sarah Boyce Jacob Walls
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113593",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T17:19:24.284736Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T18:26:21.601Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/project/Django/",
          "defaultStatus": "unaffected",
          "packageName": "django",
          "product": "Django",
          "repo": "https://github.com/django/django/",
          "vendor": "djangoproject",
          "versions": [
            {
              "lessThan": "6.1.3",
              "status": "affected",
              "version": "6.1",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "6.1.3",
              "versionType": "python"
            },
            {
              "lessThan": "6.0.10",
              "status": "affected",
              "version": "6.0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "6.0.10",
              "versionType": "python"
            },
            {
              "lessThan": "5.2.19",
              "status": "affected",
              "version": "5.2",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "5.2.19",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrew Gonzalez"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Andrew Gonzalez"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jake Howard"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Sarah Boyce"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jacob Walls"
        }
      ],
      "datePublic": "2026-11-03T09:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\u003c/p\u003e\u003cp\u003eThe \u003ccode\u003edjango.middleware.cache.UpdateCacheMiddleware\u003c/code\u003e and the \u003ccode\u003edjango.views.decorators.cache.cache_page()\u003c/code\u003e decorator generate identical cache keys for requests that omit a header listed in the response\u2019s \u003ccode\u003eVary\u003c/code\u003e header and requests that include that header with an empty value, potentially allowing remote attackers to access private data cached for another request.\u003c/p\u003e\u003cp\u003eEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\u003c/p\u003e\u003cp\u003eDjango would like to thank Andrew Gonzalez for reporting this issue.\u003c/p\u003e"
            }
          ],
          "value": "An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\nThe `django.middleware.cache.UpdateCacheMiddleware` and the `django.views.decorators.cache.cache_page()` decorator generate identical cache keys for requests that omit a header listed in the response\u2019s `Vary` header and requests that include that header with an empty value, potentially allowing remote attackers to access private data cached for another request.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Andrew Gonzalez for reporting this issue."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-204",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-204: Lifting Sensitive Data Embedded in Cache"
            }
          ]
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels",
              "value": "low"
            },
            "type": "Django severity rating"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-524",
              "description": "CWE-524: Use of Cache Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T15:42:34.362Z",
        "orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "shortName": "DSF"
      },
      "references": [
        {
          "name": "Django security archive",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.djangoproject.com/en/dev/releases/security/"
        },
        {
          "name": "Django releases announcements",
          "tags": [
            "mailing-list"
          ],
          "url": "https://groups.google.com/g/django-announce"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/django/django/commit/c0b7e5e4e4546e8ddc58262f1945938bb9d9ac2d"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/django/django/commit/55e2e009b4f3996e5c55af7b22a8c41eb826e892"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/django/django/commit/2006a2b068766bf332f1afcc32b7614d8e5759a2"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/django/django/commit/9007fecd3633cfd90b093ebe106af564347c8aee"
        },
        {
          "name": "Django security releases issued: 6.1.3, 6.0.10, and 5.2.19",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-26T12:00:00.000Z",
          "value": "Initial report received."
        },
        {
          "lang": "en",
          "time": "2026-10-08T12:00:00.000Z",
          "value": "Vulnerability confirmed."
        },
        {
          "lang": "en",
          "time": "2026-11-03T09:30:00.000Z",
          "value": "Security release issued."
        }
      ],
      "title": "Potential exposure of private data via empty and missing Vary headers",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
    "assignerShortName": "DSF",
    "cveId": "CVE-2026-113593",
    "datePublished": "2026-11-03T15:42:34.362Z",
    "dateReserved": "2026-10-20T11:47:38.571Z",
    "dateUpdated": "2026-11-03T18:26:21.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-113593",
      "date": "2026-11-04",
      "epss": "0.00464",
      "percentile": "0.40354"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://pypi.org/project/Django/",
                "defaultStatus": "unaffected",
                "packageName": "django",
                "product": "Django",
                "repo": "https://github.com/django/django/",
                "vendor": "djangoproject",
                "versions": [
                  {
                    "lessThan": "6.1.3",
                    "status": "affected",
                    "version": "6.1",
                    "versionType": "python"
                  },
                  {
                    "status": "unaffected",
                    "version": "6.1.3",
                    "versionType": "python"
                  },
                  {
                    "lessThan": "6.0.10",
                    "status": "affected",
                    "version": "6.0",
                    "versionType": "python"
                  },
                  {
                    "status": "unaffected",
                    "version": "6.0.10",
                    "versionType": "python"
                  },
                  {
                    "lessThan": "5.2.19",
                    "status": "affected",
                    "version": "5.2",
                    "versionType": "python"
                  },
                  {
                    "status": "unaffected",
                    "version": "5.2.19",
                    "versionType": "python"
                  }
                ]
              }
            ],
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\nThe `django.middleware.cache.UpdateCacheMiddleware` and the `django.views.decorators.cache.cache_page()` decorator generate identical cache keys for requests that omit a header listed in the response\u2019s `Vary` header and requests that include that header with an empty value, potentially allowing remote attackers to access private data cached for another request.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Andrew Gonzalez for reporting this issue."
          }
        ],
        "id": "CVE-2026-113593",
        "lastModified": "2026-11-03T19:17:53.890",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.1,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 1.4,
              "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
              "type": "Secondary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 2.3,
                "baseSeverity": "LOW",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-113593",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T17:19:24.284736Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-11-03T16:17:19.183",
        "references": [
          {
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "url": "https://docs.djangoproject.com/en/dev/releases/security/"
          },
          {
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "url": "https://github.com/django/django/commit/2006a2b068766bf332f1afcc32b7614d8e5759a2"
          },
          {
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "url": "https://github.com/django/django/commit/55e2e009b4f3996e5c55af7b22a8c41eb826e892"
          },
          {
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "url": "https://github.com/django/django/commit/9007fecd3633cfd90b093ebe106af564347c8aee"
          },
          {
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "url": "https://github.com/django/django/commit/c0b7e5e4e4546e8ddc58262f1945938bb9d9ac2d"
          },
          {
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "url": "https://groups.google.com/g/django-announce"
          },
          {
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "url": "https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"
          }
        ],
        "sourceIdentifier": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-524"
              }
            ],
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-113593",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-11-03T17:19:24.284736Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-11-03T17:19:32.612Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://pypi.org/project/Django/",
              "defaultStatus": "unaffected",
              "packageName": "django",
              "product": "Django",
              "repo": "https://github.com/django/django/",
              "vendor": "djangoproject",
              "versions": [
                {
                  "lessThan": "6.1.3",
                  "status": "affected",
                  "version": "6.1",
                  "versionType": "python"
                },
                {
                  "status": "unaffected",
                  "version": "6.1.3",
                  "versionType": "python"
                },
                {
                  "lessThan": "6.0.10",
                  "status": "affected",
                  "version": "6.0",
                  "versionType": "python"
                },
                {
                  "status": "unaffected",
                  "version": "6.0.10",
                  "versionType": "python"
                },
                {
                  "lessThan": "5.2.19",
                  "status": "affected",
                  "version": "5.2",
                  "versionType": "python"
                },
                {
                  "status": "unaffected",
                  "version": "5.2.19",
                  "versionType": "python"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "Andrew Gonzalez"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Andrew Gonzalez"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Jake Howard"
            },
            {
              "lang": "en",
              "type": "remediation reviewer",
              "value": "Sarah Boyce"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "Jacob Walls"
            }
          ],
          "datePublic": "2026-11-03T09:30:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\u003c/p\u003e\u003cp\u003eThe \u003ccode\u003edjango.middleware.cache.UpdateCacheMiddleware\u003c/code\u003e and the \u003ccode\u003edjango.views.decorators.cache.cache_page()\u003c/code\u003e decorator generate identical cache keys for requests that omit a header listed in the response\u2019s \u003ccode\u003eVary\u003c/code\u003e header and requests that include that header with an empty value, potentially allowing remote attackers to access private data cached for another request.\u003c/p\u003e\u003cp\u003eEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\u003c/p\u003e\u003cp\u003eDjango would like to thank Andrew Gonzalez for reporting this issue.\u003c/p\u003e"
                }
              ],
              "value": "An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\nThe `django.middleware.cache.UpdateCacheMiddleware` and the `django.views.decorators.cache.cache_page()` decorator generate identical cache keys for requests that omit a header listed in the response\u2019s `Vary` header and requests that include that header with an empty value, potentially allowing remote attackers to access private data cached for another request.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Andrew Gonzalez for reporting this issue."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-204",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-204: Lifting Sensitive Data Embedded in Cache"
                }
              ]
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels",
                  "value": "low"
                },
                "type": "Django severity rating"
              }
            },
            {
              "cvssV3_1": {
                "baseScore": 3.1,
                "baseSeverity": "LOW",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            },
            {
              "cvssV4_0": {
                "baseScore": 2.3,
                "baseSeverity": "LOW",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-524",
                  "description": "CWE-524: Use of Cache Containing Sensitive Information",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-11-03T15:42:34.362Z",
            "orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "shortName": "DSF"
          },
          "references": [
            {
              "name": "Django security archive",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://docs.djangoproject.com/en/dev/releases/security/"
            },
            {
              "name": "Django releases announcements",
              "tags": [
                "mailing-list"
              ],
              "url": "https://groups.google.com/g/django-announce"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/django/django/commit/c0b7e5e4e4546e8ddc58262f1945938bb9d9ac2d"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/django/django/commit/55e2e009b4f3996e5c55af7b22a8c41eb826e892"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/django/django/commit/2006a2b068766bf332f1afcc32b7614d8e5759a2"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/django/django/commit/9007fecd3633cfd90b093ebe106af564347c8aee"
            },
            {
              "name": "Django security releases issued: 6.1.3, 6.0.10, and 5.2.19",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "timeline": [
            {
              "lang": "en",
              "time": "2026-09-26T12:00:00.000Z",
              "value": "Initial report received."
            },
            {
              "lang": "en",
              "time": "2026-10-08T12:00:00.000Z",
              "value": "Vulnerability confirmed."
            },
            {
              "lang": "en",
              "time": "2026-11-03T09:30:00.000Z",
              "value": "Security release issued."
            }
          ],
          "title": "Potential exposure of private data via empty and missing Vary headers",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "assignerShortName": "DSF",
        "cveId": "CVE-2026-113593",
        "datePublished": "2026-11-03T15:42:34.362Z",
        "dateReserved": "2026-10-20T11:47:38.571Z",
        "dateUpdated": "2026-11-03T18:26:21.601Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.