The Wire · Showcase
DJANGO PATCHES CACHE MIDDLEWARE VULNERABILITY WHILE DOCS BUILD FINALLY WORKS
By RepoJournal · Filed · About Django
Django shipped a critical cache control bypass fix overnight while fixing a year-old documentation builder bug that broke ReadTheDocs previews.
The security fix addresses CVE-2026-35193 [1], a substring matching flaw in UpdateCacheMiddleware that could allow cache poisoning through extension directives. The vulnerability is real enough to warrant immediate attention on production systems. In parallel, the docs team fixed a persistent issue where the djangodocs Sphinx extension failed to work with anything other than a hardcoded list of HTML builders [2] [3], which meant dirhtml builds and ReadTheDocs PR previews rendered empty content blocks. That same fix also removed obsolete Sphinx 1.8 compatibility code [4], cleaning up technical debt. A third patch tightens template archive handling by enforcing safe_join() validation [5], closing a potential path traversal vector. The ASV benchmark suite picked up new ubuntu-latest results [6], giving you better performance baselines.
Action items
- → Patch Django to latest immediately for CVE-2026-35193 cache control bypass django/django [immediate]
- → Rebuild documentation if using dirhtml or custom HTML builders django/django [plan]
- → Review template archive handling in custom management commands django/django [plan]
References
- [1] Refs #36560, CVE-2026-35193 -- Replaced substring check on cache-control directives in UpdateCacheMiddleware. django/django
- [2] Fixed #37150 -- Made djangodocs Sphinx extension work with any html builder. ↗ django/django
- [3] Fixed #37150 -- Made djangodocs Sphinx extension work with any html builder. django/django
- [4] Removed obsolete Sphinx < 1.8 fallback in `VersionDirective` from djangodocs extension. django/django
- [5] Fixed #36900 -- Used safe_join() on downloaded template archive. ↗ django/django
- [6] Results for ubuntu-latest added [skip ci] django/django-asv
FAQ
- What changed in Django on June 10, 2026?
- Django shipped a critical cache control bypass fix overnight while fixing a year-old documentation builder bug that broke ReadTheDocs previews.
- What should Django teams do about it?
- Patch Django to latest immediately for CVE-2026-35193 cache control bypass • Rebuild documentation if using dirhtml or custom HTML builders • Review template archive handling in custom management commands
- Which Django repositories shipped on June 10, 2026?
- django/django, django/django-asv