CVE-2014-1418: Django - Missing Vary: Cookie and Cache-Control Header
Summary
CVE-2014-1418: Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitiv... Affects django across 4 version ranges.
>= 1.4, < 1.4.13
>= 1.5, < 1.5.8
>= 1.6, < 1.6.5
>= 1.7a0, < 1.7b4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2014-1418 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework used for building web applications. It provides a high-level API for handling web requests, managing databases, and rendering templates. Django versions 1.4 to 1.7b3 are affected by a vulnerability that results in the omission of the Vary: Cookie and Cache-Control headers in responses. This omission allows attackers to obtain sensitive information or poison the cache through specific browser requests.
Vulnerability Detail
The vulnerability in Django versions 1.4 to 1.7b3 arises from the failure to include the Vary: Cookie and Cache-Control headers in responses. These headers are essential for proper caching and security. Without them, sensitive information may be exposed to attackers, and the cache can be manipulated. This vulnerability can be exploited by sending crafted requests from certain browsers.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.4, < 1.4.131.4.13pip install --upgrade "django==1.4.13" -
>= 1.5, < 1.5.81.5.8pip install --upgrade "django==1.5.8" -
>= 1.6, < 1.6.51.6.5pip install --upgrade "django==1.6.5" -
>= 1.7a0, < 1.7b41.7b4pip install --upgrade "django==1.7b4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to upgrade to the fixed versions as soon as possible.
Conclusion
The missing Vary: Cookie and Cache-Control headers in Django versions 1.4 to 1.7b3 can lead to sensitive information exposure and cache manipulation. It is recommended to upgrade to the fixed versions mentioned above to address this vulnerability. For further assistance, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
This vulnerability allows remote attackers to obtain sensitive information or manipulate the cache of Django applications.
Django versions 1.4 to 1.7b3 are affected by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for vulnerabilities.
While specific exploits for this vulnerability are not mentioned, it is crucial to upgrade to the fixed versions to mitigate the risk.
For further support on vulnerability remediation, you can reach out to info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for django.
