The vulnerability in Django arises from the has_vary_header() function failing to normalize Vary header values by trimming whitespace before performing comparisons. This incomplete comparison (CWE-1023) can be exploited remotely to bypass cache controls and read cached responses that include whitespace-padded Vary headers. The affected versions explicitly include Django 5.2 prior to 5.2.15 and 6.0 prior to 6.0.6. No official remediation level or patch links are provided in the data, and no known exploits are reported in the wild.

An attacker can leverage this vulnerability to read cached HTTP responses that should otherwise be protected by the Vary header. This could lead to unintended information disclosure. The impact is limited to confidentiality (partial read access) with no integrity or availability effects. The CVSS score of 3.1 reflects a low severity due to the complexity and limited impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor the Django project for updates addressing this issue. Until a fix is available, consider reviewing cache configurations and Vary header usage to minimize exposure.