CVE-2026-111362

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.1.3 Django versions prior to 6.0.10 Django versions prior to 5.2.19

Description The django.contrib.gis.gdal.OGRGeometry class fails to restrict external coordinate reference system definitions within GeoJSON input. This allows remote attackers to trigger server-side requests to destinations of their choice by providing specially crafted crs members.

Recommendations Update Django to version 6.1.3 or later. Update Django to version 6.0.10 or later. Update Django to version 5.2.19 or later.