Fixed CVE-2026-8404 -- Used Cache-Control directives case-insensitively in UpdateCacheMiddleware.

Thanks Ahmed Badawe for the report, and Jacob Walls for reviews.

1 files changed, 10 insertions, 6 deletions

diff --git a/tests/cache/tests.py b/tests/cache/tests.py
index 65ca885125..d4cfadb050 100644
--- a/tests/cache/tests.py
+++ b/tests/cache/tests.py
@@ -2851,15 +2851,19 @@ class CacheMiddlewareTest(SimpleTestCase):
         Responses with 'Cache-Control: private/no-cache/no-store' are
         not cached.
         """
-        for cc in ("private", "no-cache", "no-store"):
+        for cc in ("private", "no-cache", "no-store", "PRIVATE", "NO-store"):
             with self.subTest(cache_control=cc):
-                view_with_cache = cache_page(3)(
-                    cache_control(**{cc: True})(hello_world_view)
-                )
+                # Cannot use @cache_control() as it lowercases directives.
+                @cache_page(3)
+                def view(request, value):
+                    return HttpResponse(
+                        f"Hello World {value}", headers={"Cache-Control": cc}
+                    )
+
                 request = self.factory.get("/view/")
-                response = view_with_cache(request, "1")
+                response = view(request, "1")
                 self.assertEqual(response.content, b"Hello World 1")
-                response = view_with_cache(request, "2")
+                response = view(request, "2")
                 self.assertEqual(response.content, b"Hello World 2")
 
     def test_vary_asterisk_not_cached(self):