CVE-2026-15830

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-15830
An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://docs.djangoproject.com/en/dev/releases/security/ Patch Vendor Advisory
https://github.com/django/django/commit/1eafa1a80f1363283f89208ba4499ed54e35f085
https://github.com/django/django/commit/4353dfb56f8ba3a6fccc4bdd7f2ef2fbee3aa638
https://github.com/django/django/commit/62ef9d40cf4ea75f16518436b44b8ab2515340df
https://github.com/django/django/commit/6af5da31775417c610dbf9c3f1b5b8333d42daf6 Patch
https://github.com/django/django/commit/75d401a1491e04a907ed745c128836d51c982c0f
https://github.com/django/django/commit/9e4a3f186b6b07b483bfd9195ea06734663fcd06 Patch
https://github.com/django/django/commit/ba80833fa656dd09660b97c4429331067db1b080 Patch
https://github.com/django/django/commit/d2e59b77fe18de318a8272c2a7bbc798d84d1d0d Patch
https://groups.google.com/g/django-announce Mailing List
https://www.djangoproject.com/weblog/2026/aug/04/security-releases/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
History

23 Oct 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) Se descubrió un problema en Django 6.0 anterior a la versión 6.0.9 y 5.2 anterior a la versión 5.2.18. La clase ’django.contrib.gis.geos.GEOSGeometry’ de GeoDjango es susceptible a una posible denegación de servicio al analizar objetos ’GEOMETRYCOLLECTION’ profundamente anidados, proporcionados como texto conocido (WKT), binario conocido (WKB) o WKB codificado en hexadecimal, lo que desencadena una recursión ilimitada y un fallo de segmentación en la biblioteca GEOS subyacente. Las búsquedas de campos espaciales y el campo de formulario ’django.contrib.gis.forms.GeometryField’ también se ven afectados. Series de Django anteriores y sin soporte (como 5.1.x, 5.0.x y 4.2.x) no fueron evaluadas y también podrían verse afectadas. Django desea agradecer a Andrew MacPherson y kimchunbok_ por informar de este problema.

08 Oct 2026, 11:16

Type Values Removed Values Added
Summary (en) An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue. (en) An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.
References
  • () https://github.com/django/django/commit/1eafa1a80f1363283f89208ba4499ed54e35f085 -
  • () https://github.com/django/django/commit/4353dfb56f8ba3a6fccc4bdd7f2ef2fbee3aa638 -
  • () https://github.com/django/django/commit/62ef9d40cf4ea75f16518436b44b8ab2515340df -
  • () https://github.com/django/django/commit/75d401a1491e04a907ed745c128836d51c982c0f -
Information

Published : 2026-08-04 17:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-15830

Mitre link : CVE-2026-15830

CVE.ORG link : CVE-2026-15830

JSON object : View

Products Affected

djangoproject

  • django
CWE
CWE-674

Uncontrolled Recursion