The vulnerability identified as CVE-2026-48587 involves an incomplete comparison in Django's cache handling function has_vary_header(). Specifically, the function fails to trim whitespace from Vary header values before performing comparisons. This flaw can be leveraged by remote attackers to access cached responses that include whitespace-padded Vary headers, potentially bypassing intended cache controls. The issue affects Django versions 5.2 prior to 5.2.15 and 6.0 prior to 6.0.6, with earlier unsupported versions possibly affected as well. No official remediation level or patch links are provided in the available data, and no known exploits are reported in the wild.

The impact is limited to the confidentiality of cached HTTP responses. Attackers may read cached responses that should otherwise be restricted due to improper handling of whitespace in Vary headers. There is no indication of integrity or availability impact. The CVSS score of 3.1 reflects a low severity vulnerability requiring user interaction and high attack complexity.

Patch status is not yet confirmed — check the official Django vendor advisories for current remediation guidance. Since no official patch or remediation level is provided in the data, users should monitor Django project updates for fixed releases (notably versions 5.2.15 and 6.0.6 or later). Until a patch is applied, consider reviewing cache control configurations and response headers to minimize exposure to whitespace-padded Vary headers.