django
diff --git a/‎django/middleware/cache.py‎
Lines changed: 4 additions & 0 deletions b/‎django/middleware/cache.py‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎docs/releases/5.2.14.txt‎
Lines changed: 10 additions & 0 deletions b/‎docs/releases/5.2.14.txt‎
Lines changed: 10 additions & 0 deletions
diff --git a/‎tests/cache/tests.py‎
Lines changed: 25 additions & 0 deletions b/‎tests/cache/tests.py‎
Lines changed: 25 additions & 0 deletions
@@ -104,6 +104,10 @@ def process_response(self, request, response):
         if "private" in response.get("Cache-Control", ()):
             return response
 
+        # Don't cache responses when the Vary header contains '*'.
+        if has_vary_header(response, "*"):
+            return response
+
         # Page timeout takes precedence over the "max-age" and the default
         # cache timeout.
         timeout = self.page_timeout
 
@@ -31,3 +31,13 @@ a cached public page.
 
 This issue has severity "low" according to the :ref:`Django security policy
 <security-disclosure>`.
+
+CVE-2026-6907: Potential exposure of private data due to incorrect handling of ``Vary: *`` in ``UpdateCacheMiddleware``
+=======================================================================================================================
+
+Previously, :class:`~django.middleware.cache.UpdateCacheMiddleware` would
+erroneously cache requests where the ``Vary`` header contained an asterisk
+(``'*'``). This could lead to private data being stored and served.
+
+This issue has severity "low" according to the :ref:`Django security policy
+<security-disclosure>`.
@@ -2505,6 +2505,18 @@ def hello_world_view(request, value):
     return HttpResponse("Hello World %s" % value)
 
 
+def hello_world_view_patch_vary_headers_asterisk(request, value):
+    response = HttpResponse("Hello World %s" % value)
+    patch_vary_headers(response, ("*",))
+    return response
+
+
+def hello_world_view_vary_headers_includes_asterisk(request, value):
+    response = HttpResponse("Hello World %s" % value)
+    response["Vary"] = "Cookie, *, Pony"
+    return response
+
+
 def csrf_view(request):
     return HttpResponse(csrf(request)["csrf_token"])
 
@@ -2733,6 +2745,19 @@ def test_cached_control_private_not_cached(self):
         response = view_with_private_cache(request, "2")
         self.assertEqual(response.content, b"Hello World 2")
 
+    def test_vary_asterisk_not_cached(self):
+        views_with_cache = (
+            cache_page(3)(hello_world_view_patch_vary_headers_asterisk),
+            cache_page(3)(hello_world_view_vary_headers_includes_asterisk),
+        )
+        for view in views_with_cache:
+            with self.subTest(view=view):
+                request = self.factory.get("/view/")
+                response = view(request, "1")
+                self.assertEqual(response.content, b"Hello World 1")
+                response = view(request, "2")
+                self.assertEqual(response.content, b"Hello World 2")
+
     def test_sensitive_cookie_not_cached(self):
         """
         Django must prevent caching of responses that set a user-specific (and