All vulnerabilities
CVE-2026-15830BIT-django-2026-15830GHSA-q238-5cxm-5c9hPYSEC-2026-3717

Django GeoDjango vulnerable to denial of service through deeply nested geometry collections

djangoproject djangopipFrameworks
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.11%Chance of exploitation activity in the next 30 days, higher than 65% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.2.17Also 6.0.8, 6.1.1 and 2 moreGitHub
Published4 Aug 2026Updated 12 Oct 2026CVE List

What fixes it

Show all 8 fixed versions
  • 6.0.8django, PyPIOSVpip install "django>=6.0.8"
  • 6.1.1django, PyPIOSVpip install "django>=6.1.1"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the django.contrib.gis.forms.GeometryField form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.

Text from GitHub Advisory Database

Affected versions 75

  • django, pip< 5.2.17GitHub
  • django, pip>= 6.0a1, < 6.0.8GitHub
  • django, pip>= 6.1a1, < 6.1.1GitHub
  • Djangoaffected: 6.0 before 6.0.9CVE List
  • Djangounaffected: 6.0.9CVE List
  • Djangoaffected: 5.2 before 5.2.18CVE List
  • Djangounaffected: 5.2.18CVE List
  • django, PyPIfrom first release, fixed in 5.2.17OSV
  • django, PyPI1.0.1OSV
  • django, PyPI1.0.2OSV
  • django, PyPI1.0.3OSV
  • django, PyPI1.0.4OSV
  • django, PyPI1.1OSV
  • django, PyPI1.1.1OSV
  • django, PyPI1.1.2OSV
  • django, PyPI1.1.3OSV
  • django, PyPI1.1.4OSV
  • django, PyPI1.10OSV
  • django, PyPI1.10.1OSV
  • django, PyPI1.10.2OSV
  • django, PyPI1.10.3OSV
  • django, PyPI1.10.4OSV
  • django, PyPI1.10.5OSV
  • django, PyPI1.10.6OSV
  • django, PyPI1.10.7OSV
  • django, PyPI1.10.8OSV
  • django, PyPI1.10a1OSV
  • django, PyPI1.10b1OSV
  • django, PyPI1.10rc1OSV
  • django, PyPI1.11OSV
  • django, PyPI1.11.1OSV
  • django, PyPI1.11.10OSV
  • django, PyPI1.11.11OSV
  • django, PyPI1.11.12OSV
  • django, PyPI1.11.13OSV
  • django, PyPI1.11.14OSV
  • django, PyPI1.11.15OSV
  • django, PyPI1.11.16OSV
  • django, PyPI1.11.17OSV
  • django, PyPI1.11.18OSV
  • django, PyPI1.11.2OSV
  • django, PyPI1.11.20OSV
  • django, PyPI1.11.21OSV
  • django, PyPI1.11.22OSV
  • django, PyPI1.11.23OSV
  • django, PyPI1.11.24OSV
  • django, PyPI1.11.25OSV
  • django, PyPI1.11.26OSV
  • django, PyPI1.11.27OSV
  • django, PyPI1.11.28OSV
  • django, PyPI1.11.29OSV
  • django, PyPI1.11.3OSV
  • django, PyPI1.11.4OSV
  • django, PyPI1.11.5OSV
  • django, PyPI1.11.6OSV
  • django, PyPI1.11.7OSV
  • django, PyPI1.11.8OSV
  • django, PyPI1.11.9OSV
  • django, PyPIfrom 6.0a1, fixed in 6.0.8OSV
  • django, PyPI6.0OSV
  • django, PyPI6.0.1OSV
  • django, PyPI6.0.2OSV
  • django, PyPI6.0.3OSV
  • django, PyPI6.0.4OSV
  • django, PyPI6.0.5OSV
  • django, PyPI6.0.6OSV
  • django, PyPI6.0.7OSV
  • django, PyPI6.0a1OSV
  • django, PyPI6.0b1OSV
  • django, PyPI6.0rc1OSV
  • django, PyPIfrom 6.1a1, fixed in 6.1.1OSV
  • django, PyPI6.1OSV
  • django, PyPI6.1a1OSV
  • django, PyPI6.1b1OSV
  • django, PyPI6.1rc1OSV

References 16