From a2faa8e895926ac5d63f72879b5ccf671b5b4ba9 Mon Sep 17 00:00:00 2001 From: Jacob Walls Date: Tue, 24 Mar 2026 14:06:22 -0400 Subject: Fixed CVE-2026-35193 -- Varied on Authorization when caching non-public responses. Thanks Shai Berger for the report, and Natalia Bidart and Sarah Boyce for reviews. --- docs/releases/5.2.15.txt | 13 +++++++++++++ docs/releases/6.0.6.txt | 13 +++++++++++++ docs/topics/cache.txt | 12 ++++++++++++ 3 files changed, 38 insertions(+) (limited to 'docs') diff --git a/docs/releases/5.2.15.txt b/docs/releases/5.2.15.txt index c068600280..ed95b646ce 100644 --- a/docs/releases/5.2.15.txt +++ b/docs/releases/5.2.15.txt @@ -51,3 +51,16 @@ where ``Cache-Control`` is set manually. This issue has severity "low" according to the :ref:`Django security policy `. + +CVE-2026-35193: Potential exposure of private data via missing ``Vary: Authorization`` +====================================================================================== + +:class:`~django.middleware.cache.UpdateCacheMiddleware` and +:func:`~django.views.decorators.cache.cache_page` decorator allowed responses +to requests bearing an ``Authorization`` header (and without ``Cache-Control: +public``) to be cached. To conform with the existing mechanism for constructing +cache keys, responses to these requests will now :ref:`vary on +` ``Authorization``. + +This issue has severity "low" according to the :ref:`Django security policy +`. diff --git a/docs/releases/6.0.6.txt b/docs/releases/6.0.6.txt index afcbbe0eb2..a460621232 100644 --- a/docs/releases/6.0.6.txt +++ b/docs/releases/6.0.6.txt @@ -53,6 +53,19 @@ where ``Cache-Control`` is set manually. This issue has severity "low" according to the :ref:`Django security policy `. +CVE-2026-35193: Potential exposure of private data via missing ``Vary: Authorization`` +====================================================================================== + +:class:`~django.middleware.cache.UpdateCacheMiddleware` and +:func:`~django.views.decorators.cache.cache_page` decorator allowed responses +to requests bearing an ``Authorization`` header (and without ``Cache-Control: +public``) to be cached. To conform with the existing mechanism for constructing +cache keys, responses to these requests will now :ref:`vary on +` ``Authorization``. + +This issue has severity "low" according to the :ref:`Django security policy +`. + Bugfixes ======== diff --git a/docs/topics/cache.txt b/docs/topics/cache.txt index 37384c3b8a..9af28a9324 100644 --- a/docs/topics/cache.txt +++ b/docs/topics/cache.txt @@ -1403,6 +1403,18 @@ second argument. For more on Vary headers, see the :rfc:`official Vary spec <9110#section-12.5.5>`. +.. admonition:: ``CacheMiddleware`` varies on ``Authorization`` automatically + + Although varying on ``Authorization`` is not strictly necessary given that + :rfc:`9111#section-3.5` allows caches to avoid reusing authenticated + responses, Django's ``CacheMiddleware`` adds ``Authorization`` to the + ``Vary`` header to simplify construction of cache keys. + +.. versionchanged:: 6.0.6 + + Previously, ``UpdateCacheMiddleware`` did not vary on ``Authorization`` for + requests bearing that header. + Controlling cache: Using other headers ====================================== -- cgit v1.3