... re of private data via case-sensitive Cache-Control directives ¶ UpdateCacheMiddleware and cache_page() incorrectly cached responses marked with private Cache-Control directives when using mixed or uppercase values (e.g. Private ). The cache_control() dec ... nd patch_cache_control() function were not affected, since they normalize directives to lowercase. This issue only affects responses where Cache-Control is set manually. This issue has severity "low" according to the Django security policy . CVE-2026-3519 ... ential exposure of private data via missing Vary: Authorization ¶ UpdateCacheMiddleware and cache_page() decorator allowed responses to requests bearing an Authorization header (and without Cache-Control: public ) to be cached. To conform with the existin ... ... re of private data via case-sensitive Cache-Control directives ¶ UpdateCacheMiddleware and cache_page() incorrectly cached responses marked with private Cache-Control directives when using mixed or uppercase values (e.g. Private ). The cache_control() dec ... nd patch_cache_control() function were not affected, since they normalize directives to lowercase. This issue only affects responses where Cache-Control is set manually. This issue has severity "low" according to the Django security policy . CVE-2026-3519 ... ential exposure of private data via missing Vary: Authorization ¶ UpdateCacheMiddleware and cache_page() decorator allowed responses to requests bearing an Authorization header (and without Cache-Control: public ) to be cached. To conform with the existin ... ... re of private data via case-sensitive Cache-Control directives ¶ UpdateCacheMiddleware and cache_page() incorrectly cached responses marked with private Cache-Control directives when using mixed or uppercase values (e.g. Private ). The cache_control() dec ... nd patch_cache_control() function were not affected, since they normalize directives to lowercase. This issue only affects responses where Cache-Control is set manually. This issue has severity "low" according to the Django security policy . CVE-2026-3519 ... ential exposure of private data via missing Vary: Authorization ¶ UpdateCacheMiddleware and cache_page() decorator allowed responses to requests bearing an Authorization header (and without Cache-Control: public ) to be cached. To conform with the existin ... ... re of private data via case-sensitive Cache-Control directives ¶ UpdateCacheMiddleware and cache_page() incorrectly cached responses marked with private Cache-Control directives when using mixed or uppercase values (e.g. Private ). The cache_control() dec ... nd patch_cache_control() function were not affected, since they normalize directives to lowercase. This issue only affects responses where Cache-Control is set manually. This issue has severity "low" according to the Django security policy . CVE-2026-3519 ... ential exposure of private data via missing Vary: Authorization ¶ UpdateCacheMiddleware and cache_page() decorator allowed responses to requests bearing an Authorization header (and without Cache-Control: public ) to be cached. To conform with the existin ... ... re of private data via cached Set-Cookie response ¶ UpdateCacheMiddleware and cache_page() avoided caching responses that set a cookie while varying on Cookie only when the incoming request contained no cookies at all. When the request alr ... r accepted newlines in input ¶ DomainNameValidator accepted newlines in domain names. If such values were included in HTTP responses, header injection attacks were possible. Django itself wasn't vulnerable because HttpResponse prohibits newlines in HTTP h ... 連キーワード severity cookie newlines issue according security policy buffer were DomainNameValidator Cookie response cache responses request stored over read GDALRaster bytes affected injection accepted release notes July クイック検索 Last update: 2026年1 ... ... re of private data via cached Set-Cookie response ¶ UpdateCacheMiddleware and cache_page() avoided caching responses that set a cookie while varying on Cookie only when the incoming request contained no cookies at all. When the request alr ... r accepted newlines in input ¶ DomainNameValidator accepted newlines in domain names. If such values were included in HTTP responses, header injection attacks were possible. Django itself wasn't vulnerable because HttpResponse prohibits newlines in HTTP h ... Django severity low cookie newlines issue according security policy buffer were DomainNameValidator Cookie response cache responses request stored over read GDALRaster 関連するページ Django 6.0.7 release notes Django 6.0.6 release notes Django 5.2.15 rel ... ... al exposure of private data via cached Set-Cookie response ¶ UpdateCacheMiddleware and cache_page() avoided caching responses that set a cookie while varying on Cookie only when the incoming request contained no cookies at all. When the request alr ... r accepted newlines in input ¶ DomainNameValidator accepted newlines in domain names. If such values were included in HTTP responses, header injection attacks were possible. Django itself wasn't vulnerable because HttpResponse prohibits newlines in HTTP h ... ワード severity cookie bytes were newlines issue according security policy buffer DomainNameValidator Cookie response cache responses request stored over read GDALRaster affected injection accepted release notes July クイック検索 Last update: 2026年10月09日 ... ... al exposure of private data via cached Set-Cookie response ¶ UpdateCacheMiddleware and cache_page() avoided caching responses that set a cookie while varying on Cookie only when the incoming request contained no cookies at all. When the request alr ... r accepted newlines in input ¶ DomainNameValidator accepted newlines in domain names. If such values were included in HTTP responses, header injection attacks were possible. Django itself wasn't vulnerable because HttpResponse prohibits newlines in HTTP h ... o severity low cookie bytes were newlines issue according security policy buffer DomainNameValidator Cookie response cache responses request stored over read 関連するページ Django 5.2.16 release notes Django 6.0.6 release notes Django 5.2.15 release notes ... ... ects the following problems: The patch applied for the security issue covered in Django 1.2.2 caused issues with non-ASCII responses using CSRF tokens. The patch also caused issues with some forms, most notably the user-editing forms in the Django adminis ... atch caused issues forms リリースノート fixed couple released days after corrects following applied security issue covered responses using tokens also most notably user クイック検索 Last update: 2026年10月09日 « previous | up | next » ... ... rts streaming responses. As part of the 1.4.18 security release, the django.views.static.serve() function was altered to stream the files it serve ... キーワード security release GZipMiddleware stream files リリースノート January fixes regression バグ 修正 supports streaming responses part views static serve altered serves Unfortunately consumed prematurely prevented served クイック検索 Last update: 2026年 ... 2026年10月08日