Django Whitespace Vary Header Caching Vulnerability

A vulnerability exists in Django versions 5.2 prior to 5.2.15 and 6.0 prior to 6.0.6, where the `django.utils.cache.has_vary_header()` function does not remove leading or trailing whitespace from `Vary` header values before making comparisons. This oversight allows remote attackers to access cached responses by sending requests to URLs with whitespace-padded `Vary` header values. Earlier, unsupported Django versions (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected but were not evaluated.

Impact

Exploitation of this vulnerability could lead to unintended exposure of cached private data.

Remediation

Users can upgrade to Django versions 5.2.15 or 6.0.6 to address this vulnerability.