... to the Django security policy . CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware ¶ Previously, UpdateCacheMiddleware would erroneously cache requests where the Vary header contained an asterisk ( '*' ). ... s and SESSION_SAVE_EVERY_REQUEST CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware 前のトピックへ Django 5.2.15 release notes 次のトピックへ Django 5.2.13 release notes 関連キーワード severity requests lim ... it issue according security policy Potential service bypass header cached session user private Vary UpdateCacheMiddleware release notes fixes three security issues denial vulnerability upload クイック検索 Last update: 2026年10月09日 « previous ... ... to the Django security policy . CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware ¶ Previously, UpdateCacheMiddleware would erroneously cache requests where the Vary header contained an asterisk ( '*' ). ... s and SESSION_SAVE_EVERY_REQUEST CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware 前のトピックへ Django 5.2.15 release notes 次のトピックへ Django 5.2.13 release notes 関連キーワード Django severity low r ... equests limit issue according security policy Potential service via bypass header cached session user private data Vary UpdateCacheMiddleware 関連するページ Django 6.0.5 release notes Django 6.0.6 release notes Django 5.2.15 release notes Django 4.2.28 release not ... ... to the Django security policy . CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware ¶ Previously, UpdateCacheMiddleware would erroneously cache requests where the Vary header contained an asterisk ( '*' ). ... s and SESSION_SAVE_EVERY_REQUEST CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware バグ修正 前のトピックへ Django 6.0.6 release notes 次のトピックへ Django 6.0.4 release notes 関連キーワード severity reque ... sts limit issue according security policy Potential service bypass header cached session user private Vary UpdateCacheMiddleware Fixed admin release notes fixes three security issues several クイック検索 Last update: 2026年10月09日 « previous | up | n ... ... to the Django security policy . CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware ¶ Previously, UpdateCacheMiddleware would erroneously cache requests where the Vary header contained an asterisk ( '*' ). ... s and SESSION_SAVE_EVERY_REQUEST CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware バグ修正 前のトピックへ Django 6.0.6 release notes 次のトピックへ Django 6.0.4 release notes 関連キーワード Django severit ... w requests limit issue according security policy Potential service via bypass header cached session user private data Vary UpdateCacheMiddleware 関連するページ Django 5.2.14 release notes Django 6.0.6 release notes Django 5.2.15 release notes Django 4.2.28 release no ... ... e Django security policy . CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives ¶ UpdateCacheMiddleware and cache_page() incorrectly cached responses marked with private Cache-Control directives when using mixed or uppercase v ... rding to the Django security policy . CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization ¶ UpdateCacheMiddleware and cache_page() decorator allowed responses to requests bearing an Authorization header (and without Cache-Control: publi ... to the Django security policy . CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header ¶ UpdateCacheMiddleware incorrectly cached responses whose Vary header values contained leading or trailing whitespace. Because has_vary_header() ... ... e Django security policy . CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives ¶ UpdateCacheMiddleware and cache_page() incorrectly cached responses marked with private Cache-Control directives when using mixed or uppercase v ... rding to the Django security policy . CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization ¶ UpdateCacheMiddleware and cache_page() decorator allowed responses to requests bearing an Authorization header (and without Cache-Control: publi ... to the Django security policy . CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header ¶ UpdateCacheMiddleware incorrectly cached responses whose Vary header values contained leading or trailing whitespace. Because has_vary_header() ... ... e Django security policy . CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives ¶ UpdateCacheMiddleware and cache_page() incorrectly cached responses marked with private Cache-Control directives when using mixed or uppercase v ... rding to the Django security policy . CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization ¶ UpdateCacheMiddleware and cache_page() decorator allowed responses to requests bearing an Authorization header (and without Cache-Control: publi ... to the Django security policy . CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header ¶ UpdateCacheMiddleware incorrectly cached responses whose Vary header values contained leading or trailing whitespace. Because has_vary_header() ... ... e Django security policy . CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives ¶ UpdateCacheMiddleware and cache_page() incorrectly cached responses marked with private Cache-Control directives when using mixed or uppercase v ... rding to the Django security policy . CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization ¶ UpdateCacheMiddleware and cache_page() decorator allowed responses to requests bearing an Authorization header (and without Cache-Control: publi ... to the Django security policy . CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header ¶ UpdateCacheMiddleware incorrectly cached responses whose Vary header values contained leading or trailing whitespace. Because has_vary_header() ... ... 方法についての情報は、 ミドルウェア使用ガイド を参照してください。 使用できる middleware ¶ Cache middleware ¶ class UpdateCacheMiddleware [ソース] ¶ class FetchFromCacheMiddleware [ソース] ¶ サイト全体でキャッシュを有効にします。有効にすると、Django を利用して ... リダイレクトを有効にしているなら、他のたくさんの必要のないミドルウェアが実行されないように、リストの先頭付近に置くべきです。 UpdateCacheMiddleware Vary ヘッダに変更を加えるミドルウェア ( SessionMiddleware , GZipMiddleware , LocaleMiddleware ) の前に置きます。 GZipMiddl ... eware response body を変更・使用する可能性のあるミドルウェアの前に置きます。 Vary ヘッダを修正するため、 UpdateCacheMiddleware の後に置きます。 SessionMiddleware CSRF_USE_SESSIONS を使用している場合、例えば PermissionDenied のようなエラービューをトリ ... ... 方法についての情報は、 ミドルウェア使用ガイド を参照してください。 使用できる middleware ¶ Cache middleware ¶ class UpdateCacheMiddleware [ソース] ¶ class FetchFromCacheMiddleware [ソース] ¶ サイト全体でキャッシュを有効にします。有効にすると、Django を利用して ... リダイレクトを有効にしているなら、他のたくさんの必要のないミドルウェアが実行されないように、リストの先頭付近に置くべきです。 UpdateCacheMiddleware Vary ヘッダに変更を加えるミドルウェア ( SessionMiddleware , GZipMiddleware , LocaleMiddleware ) の前に置きます。 GZipMiddl ... eware response body を変更・使用する可能性のあるミドルウェアの前に置きます。 Vary ヘッダを修正するため、 UpdateCacheMiddleware の後に置きます。 SessionMiddleware CSRF_USE_SESSIONS を使用している場合、例えば PermissionDenied のようなエラービューをトリ ... 2026年10月08日