티스토리 수익 글 보기

티스토리 수익 글 보기

[6.0.x] Fixed CVE-2026-8404 — Used Cache-Control directives case-ins… · django/django@b433025 · GitHub
Skip to content

Commit b433025

Browse files
RealOrangeOnenessita
RealOrangeOne
authored and
nessita
committed
[6.0.x] Fixed CVE-2026-8404 — Used Cache-Control directives case-insensitively in UpdateCacheMiddleware.
Thanks Ahmed Badawe for the report, and Jacob Walls for reviews. Backport of d618d7a from main.
1 parent 625a670 commit b433025

4 files changed

Lines changed: 44 additions & 8 deletions

File tree

‎django/middleware/cache.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -102,8 +102,8 @@ def process_response(self, request, response):
102102

103103
# Don't cache responses when the Cache-Control header is set to
104104
# private, no-cache, or no-store.
105-
cache_control = response.get("Cache-Control", ())
106-
if any(
105+
cache_control = response.get("Cache-Control", "").lower()
106+
if cache_control and any(
107107
directive in cache_control
108108
for directive in (
109109
"private",

‎docs/releases/5.2.15.txt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,19 @@ Connections configured with :setting:`EMAIL_USE_SSL` are not affected.
3535

3636
This issue has severity "low" according to the :ref:`Django security policy
3737
<severity-levels>`.
38+
39+
CVE-2026-8404: Potential exposure of private data via case-sensitive ``Cache-Control`` directives
40+
=================================================================================================
41+
42+
:class:`~django.middleware.cache.UpdateCacheMiddleware` and
43+
:func:`~django.views.decorators.cache.cache_page` incorrectly cached responses
44+
marked with private ``Cache-Control`` directives when using mixed or uppercase
45+
values (e.g. ``Private``).
46+
47+
The :func:`~django.views.decorators.cache.cache_control` decorator and
48+
:func:`~django.utils.cache.patch_cache_control` function were not affected,
49+
since they normalize directives to lowercase. This issue only affects responses
50+
where ``Cache-Control`` is set manually.
51+
52+
This issue has severity "low" according to the :ref:`Django security policy
53+
<severity-levels>`.

‎docs/releases/6.0.6.txt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,22 @@ Connections configured with :setting:`EMAIL_USE_SSL` are not affected.
3737
This issue has severity "low" according to the :ref:`Django security policy
3838
<severity-levels>`.
3939

40+
CVE-2026-8404: Potential exposure of private data via case-sensitive ``Cache-Control`` directives
41+
=================================================================================================
42+
43+
:class:`~django.middleware.cache.UpdateCacheMiddleware` and
44+
:func:`~django.views.decorators.cache.cache_page` incorrectly cached responses
45+
marked with private ``Cache-Control`` directives when using mixed or uppercase
46+
values (e.g. ``Private``).
47+
48+
The :func:`~django.views.decorators.cache.cache_control` decorator and
49+
:func:`~django.utils.cache.patch_cache_control` function were not affected,
50+
since they normalize directives to lowercase. This issue only affects responses
51+
where ``Cache-Control`` is set manually.
52+
53+
This issue has severity "low" according to the :ref:`Django security policy
54+
<severity-levels>`.
55+
4056
Bugfixes
4157
========
4258

‎tests/cache/tests.py‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2748,15 +2748,19 @@ def test_cache_control_not_cached(self):
27482748
Responses with 'Cache-Control: private/no-cache/no-store' are
27492749
not cached.
27502750
"""
2751-
for cc in ("private", "no-cache", "no-store"):
2751+
for cc in ("private", "no-cache", "no-store", "PRIVATE", "NO-store"):
27522752
with self.subTest(cache_control=cc):
2753-
view_with_cache = cache_page(3)(
2754-
cache_control(**{cc: True})(hello_world_view)
2755-
)
2753+
# Cannot use @cache_control() as it lowercases directives.
2754+
@cache_page(3)
2755+
def view(request, value):
2756+
return HttpResponse(
2757+
f"Hello World {value}", headers={"Cache-Control": cc}
2758+
)
2759+
27562760
request = self.factory.get("/view/")
2757-
response = view_with_cache(request, "1")
2761+
response = view(request, "1")
27582762
self.assertEqual(response.content, b"Hello World 1")
2759-
response = view_with_cache(request, "2")
2763+
response = view(request, "2")
27602764
self.assertEqual(response.content, b"Hello World 2")
27612765

27622766
def test_vary_asterisk_not_cached(self):

0 commit comments

Comments
 (0)