CVE-2026-8404 is a vulnerability in Django's UpdateCacheMiddleware where the Cache-Control response directives are matched case-sensitively rather than case-insensitively. This improper handling of case sensitivity (CWE-178) can cause responses with uppercase or mixed-case Cache-Control headers to be cached incorrectly, potentially allowing remote attackers to read responses that should not have been cached. The issue affects Django 5.2 prior to 5.2.15 and 6.0 prior to 6.0.6, with earlier unsupported versions possibly impacted but not evaluated. No official fix or remediation guidance is provided in the available data.

The vulnerability allows remote attackers to access cached responses that were not intended to be cached due to case-sensitive matching of Cache-Control headers. This could lead to unintended information disclosure. The CVSS score is 3.1 (low), indicating limited impact primarily related to confidentiality. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Users should monitor for updates from the Django project and apply patches once available.