Potential exposure of private data via whitespace padding in Vary header

Django's cache comparison feature doesn't remove spaces from HTTP header values, allowing attackers to bypass cache validation and access responses that should be private. This happens because the comparison logic treats 'Content-Type' and ' Content-Type ' as different values.

CVE-2026-48587 affects Django versions 5.2 before 5.2.15 and 6.0 before 6.0.6 in the `has_vary_header()` function, which fails to normalize whitespace in Vary header values before comparison. An attacker can craft requests with whitespace-padded header values to bypass cache validation and retrieve cached responses intended for different audiences, leading to information disclosure. The vulnerability requires the application to cache responses based on Vary headers without proper normalization.