CVE-2026-15830

Name of the Vulnerable Software and Affected Versions Django versions 5.2 through 5.2.16 Django versions 6.0 through 6.0.7

Description GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects provided as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB. This occurs because the process triggers unbounded recursion, leading to a segmentation fault in the underlying GEOS library. This issue also affects spatial field lookups and the django.contrib.gis.forms.GeometryField form field.

Recommendations Update to version 5.2.17. Update to version 6.0.8.