CVE-2026-15830
Potential denial-of-service vulnerability via nested geometry collections
- State
- Published
- Severity
- 6.9 Medium
- Published
- Aug 4, 2026
- Updated
- Oct 8, 2026
- Reserved
- Jul 15, 2026
Description
An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | DSF |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | DSF |
Weaknesses
- CWE-674 Uncontrolled Recursion
Affected Products
| Product | Versions |
|---|---|
Djangodjangoproject |
|
References
- Django security archivevendor-advisory
- Django releases announcementsmailing-list
- https://github.com/django/django/commit/d2e59b77fe18de318a8272c2a7bbc798d84d1d0dpatch
- https://github.com/django/django/commit/9e4a3f186b6b07b483bfd9195ea06734663fcd06patch
- https://github.com/django/django/commit/6af5da31775417c610dbf9c3f1b5b8333d42daf6patch
- https://github.com/django/django/commit/ba80833fa656dd09660b97c4429331067db1b080patch
- Django security releases issued: 6.0.8 and 5.2.17vendor-advisory
- https://github.com/django/django/commit/62ef9d40cf4ea75f16518436b44b8ab2515340dfpatch
- https://github.com/django/django/commit/75d401a1491e04a907ed745c128836d51c982c0fpatch
- https://github.com/django/django/commit/4353dfb56f8ba3a6fccc4bdd7f2ef2fbee3aa638patch
- https://github.com/django/django/commit/1eafa1a80f1363283f89208ba4499ed54e35f085patch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.