PT-2026-67752
CVE-2026-15830
·
Published
2026-08-04
·
Updated
2026-10-24
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Django versions 5.2 through 5.2.16
Django versions 6.0 through 6.0.7
Description
GeoDjango's
django.contrib.gis.geos.GEOSGeometry is subject to a denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects provided as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB. This occurs because the process triggers unbounded recursion, leading to a segmentation fault in the underlying GEOS library. This issue also affects spatial field lookups and the django.contrib.gis.forms.GeometryField form field.Recommendations
Update to version 5.2.17.
Update to version 6.0.8.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾