Cyber Resilience

CVE-2026-48587

Djangoproject Django 5.2 – 5.2.15

Published
03 June 2026
Modified
21 July 2026
Patch / advisory
View advisory
CVSS Score v4 2.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0035 28th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2026-48587 is a low-severity Incomplete Comparison with Missing Factors (CWE-1023) vulnerability in Djangoproject Django. Its CVSS base score is 2.3 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerading (T1036); ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests…

more

to URLs whose responses contain whitespace-padded Vary header values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Navid Rezazadeh for reporting this issue.

CWE(s)
CWE-1023

Related Threats

MITRE ATT&CK Enterprise Techniques

T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
attack.mitre.org →
T1553 Subvert Trust Controls Defense Impairment
Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-8404Same product: Djangoproject Django
CVE-2026-6873Same product: Djangoproject Django
CVE-2026-3902Same product: Djangoproject Django
CVE-2022-34265Same product: Djangoproject Django
CVE-2024-39330Same product: Djangoproject Django
CVE-2026-1207Same product: Djangoproject Django
CVE-2026-1287Same product: Djangoproject Django
CVE-2024-24680Same product: Djangoproject Django
CVE-2024-41989Same product: Djangoproject Django
CVE-2025-59682Same product: Djangoproject Django

Affected Assets

djangoproject
django
5.2 — 5.2.15 · 6.0 — 6.0.6

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V6.3.4
  • V6.3.5
  • V6.1.3
  • V6.5.7

Mitigating Controls (NIST 800-53 r5) AI

AC-24 Access Control Decisions partial match

Mandating that access-control decisions apply the full set of required rules to each request structurally eliminates missing-factor comparisons.

AC-3 Access Enforcement partial match

Access enforcement requires that every authorization decision evaluate all relevant entity attributes, directly stopping incomplete comparisons from being used.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices (reviews, testing, static analysis) directly prevent incomplete comparison flaws from being introduced.

PR.AA-03 partial match
prevents

Authentication decisions often rely on multi-factor comparisons; incomplete comparisons directly weaken this control.

PR.AA-05 partial match
prevents

Enforcing access policy requires complete evaluation of all relevant attributes; missing factors undermine authorization decisions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect missing comparison factors, yet testing is only one part of the control's scope.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate complete multi-factor comparisons, but the control is broader than this single weakness.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles can require exhaustive entity comparisons, yet the control addresses many other design concerns.

A.8.28 Secure coding partial match
prevents

Secure coding standards can forbid incomplete comparisons, but the control covers a wide range of coding issues.

References