Django versions 5.2 prior to 5.2.15 and 6.0 prior to 6.0.6 contain a flaw in UpdateCacheMiddleware where the Cache-Control response directives are matched case-sensitively. If a response header uses uppercase or mixed‑case values, the middleware may cache the response despite the presence of a no‑cache directive, allowing an attacker to retrieve data that should have been protected. The weakness manifests as inadvertent disclosure of private or sensitive information through cached responses.

All deployments of Django 5.2 before 5.2.15 and Django 6.0 before 6.0.6 are impacted. The ad‑hoc mention of older unsupported series such as 5.0.x, 4.1.x, and 3.2.x suggests that these may also exhibit the same behavior, but no official assessment is provided.

The CVSS score of 2.3 indicates a low severity vulnerability. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, implying limited publicly documented exploitation. The attack surface is remote, hinging on the presence of UpdateCacheMiddleware and mis‑configured Cache‑Control headers; an attacker can trigger the insecure caching behavior from anywhere over the network by sending crafted HTTP requests.