티스토리 수익 글 보기

티스토리 수익 글 보기

[6.1.x] Fixed CVE-2026-8404 — Used Cache-Control directives case-ins… · django/django@130467c · GitHub
Skip to content

Commit 130467c

Browse files
RealOrangeOnenessita
RealOrangeOne
authored and
nessita
committed
[6.1.x] Fixed CVE-2026-8404 — Used Cache-Control directives case-insensitively in UpdateCacheMiddleware.
Thanks Ahmed Badawe for the report, and Jacob Walls for reviews. Backport of d618d7a from main.
1 parent afd82a5 commit 130467c

4 files changed

Lines changed: 44 additions & 8 deletions

File tree

‎django/middleware/cache.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -102,8 +102,8 @@ def process_response(self, request, response):
102102

103103
# Don't cache responses when the Cache-Control header is set to
104104
# private, no-cache, or no-store.
105-
cache_control = response.get("Cache-Control", ())
106-
if any(
105+
cache_control = response.get("Cache-Control", "").lower()
106+
if cache_control and any(
107107
directive in cache_control
108108
for directive in (
109109
"private",

‎docs/releases/5.2.15.txt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,19 @@ Connections configured with :setting:`EMAIL_USE_SSL` are not affected.
3535

3636
This issue has severity "low" according to the :ref:`Django security policy
3737
<severity-levels>`.
38+
39+
CVE-2026-8404: Potential exposure of private data via case-sensitive ``Cache-Control`` directives
40+
=================================================================================================
41+
42+
:class:`~django.middleware.cache.UpdateCacheMiddleware` and
43+
:func:`~django.views.decorators.cache.cache_page` incorrectly cached responses
44+
marked with private ``Cache-Control`` directives when using mixed or uppercase
45+
values (e.g. ``Private``).
46+
47+
The :func:`~django.views.decorators.cache.cache_control` decorator and
48+
:func:`~django.utils.cache.patch_cache_control` function were not affected,
49+
since they normalize directives to lowercase. This issue only affects responses
50+
where ``Cache-Control`` is set manually.
51+
52+
This issue has severity "low" according to the :ref:`Django security policy
53+
<severity-levels>`.

‎docs/releases/6.0.6.txt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,22 @@ Connections configured with :setting:`EMAIL_USE_SSL` are not affected.
3737
This issue has severity "low" according to the :ref:`Django security policy
3838
<severity-levels>`.
3939

40+
CVE-2026-8404: Potential exposure of private data via case-sensitive ``Cache-Control`` directives
41+
=================================================================================================
42+
43+
:class:`~django.middleware.cache.UpdateCacheMiddleware` and
44+
:func:`~django.views.decorators.cache.cache_page` incorrectly cached responses
45+
marked with private ``Cache-Control`` directives when using mixed or uppercase
46+
values (e.g. ``Private``).
47+
48+
The :func:`~django.views.decorators.cache.cache_control` decorator and
49+
:func:`~django.utils.cache.patch_cache_control` function were not affected,
50+
since they normalize directives to lowercase. This issue only affects responses
51+
where ``Cache-Control`` is set manually.
52+
53+
This issue has severity "low" according to the :ref:`Django security policy
54+
<severity-levels>`.
55+
4056
Bugfixes
4157
========
4258

‎tests/cache/tests.py‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2851,15 +2851,19 @@ def test_cache_control_not_cached(self):
28512851
Responses with 'Cache-Control: private/no-cache/no-store' are
28522852
not cached.
28532853
"""
2854-
for cc in ("private", "no-cache", "no-store"):
2854+
for cc in ("private", "no-cache", "no-store", "PRIVATE", "NO-store"):
28552855
with self.subTest(cache_control=cc):
2856-
view_with_cache = cache_page(3)(
2857-
cache_control(**{cc: True})(hello_world_view)
2858-
)
2856+
# Cannot use @cache_control() as it lowercases directives.
2857+
@cache_page(3)
2858+
def view(request, value):
2859+
return HttpResponse(
2860+
f"Hello World {value}", headers={"Cache-Control": cc}
2861+
)
2862+
28592863
request = self.factory.get("/view/")
2860-
response = view_with_cache(request, "1")
2864+
response = view(request, "1")
28612865
self.assertEqual(response.content, b"Hello World 1")
2862-
response = view_with_cache(request, "2")
2866+
response = view(request, "2")
28632867
self.assertEqual(response.content, b"Hello World 2")
28642868

28652869
def test_vary_asterisk_not_cached(self):

0 commit comments

Comments
 (0)