The Django team has released security updates 6.0.7 and 5.2.16 on July 7, 2026, to address three vulnerabilities classified as low severity. Patches have been applied to the main, 6.1 beta, 6.0, and 5.2 branches.

CVE-2026-48588 involves a flaw in UpdateCacheMiddleware and the cache_page decorator. When a request already contained an unrelated cookie, the system could inadvertently store responses containing sensitive session or Set-Cookie cookies in the shared cache, potentially exposing private data.

CVE-2026-53877 describes a heap buffer over-read in GDALRaster. When instantiated with a bytes object for a raster file in GDAL's virtual filesystem, the vsi_buffer property could read approximately 32 bytes beyond the allocated buffer, leading to potential memory disclosure or segmentation faults.

CVE-2026-53878 concerns DomainNameValidator, which permitted newlines in input. While Django's HttpResponse prevents header injection by prohibiting newlines, the validator's behavior could be exploited if used outside of standard Django form fields, which normally strip such characters.