MediumFix available

Potential denial-of-service vulnerability via nested geometry collections

Type: advisorySources: OSV

An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.

Products: django
Affected versions: Not specified
Fixed versions: 5.2.17, 6.0.8
CVEs: CVE-2026-15830
Confirmed fixed CVEs: Not specified
Updated in this feed: 28 Oct 2026, 12:32 UTC · Revision 1

Source evidence

Potential denial-of-service vulnerability via nested geometry collections

core-osv · Original source

Published 19 Aug 2026, 08:39 UTC

osv:BIT-django-2026-15830

django

Fixed versions: 5.2.17, 6.0.8

Complete source record

{
  "id": "9e258ba466a471ba8dfae098777b5fb504eea9856390adb8d61cb79d967e7b06",
  "url": "https://osv.dev/vulnerability/BIT-django-2026-15830",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Potential denial-of-service vulnerability via nested geometry collections",
    "summary": "An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.",
    "evidence": "osv:BIT-django-2026-15830",
    "products": [
      {
        "name": {
          "value": "django",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.2.17",
            "evidence": "/affected/0/ranges"
          },
          {
            "value": "6.0.8",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "BIT-django-2026-15830",
      "aliases": [
        "BIT-django-2026-15830",
        "CVE-2026-15830",
        "GHSA-q238-5cxm-5c9h",
        "PYSEC-2026-3717"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "5.2.17"
                },
                {
                  "introduced": "6.0.0"
                },
                {
                  "fixed": "6.0.8"
                }
              ]
            }
          ],
          "package": {
            "name": "django",
            "purl": "pkg:bitnami/django",
            "ecosystem": "Bitnami"
          },
          "severity": [
            {
              "type": "CVSS_V4",
              "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
            }
          ],
          "database_specific": {
            "source": "https://github.com/bitnami/vulndb/tree/main/data/django/BIT-django-2026-15830.json"
          }
        }
      ],
      "modified": "2026-10-09T12:00:06.455183269Z",
      "provider": "osv",
      "references": [
        "https://docs.djangoproject.com/en/dev/releases/security/",
        "https://github.com/django/django/commit/6af5da31775417c610dbf9c3f1b5b8333d42daf6",
        "https://github.com/django/django/commit/9e4a3f186b6b07b483bfd9195ea06734663fcd06",
        "https://github.com/django/django/commit/ba80833fa656dd09660b97c4429331067db1b080",
        "https://github.com/django/django/commit/d2e59b77fe18de318a8272c2a7bbc798d84d1d0d",
        "https://groups.google.com/g/django-announce",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-15830",
        "https://www.djangoproject.com/weblog/2026/aug/04/security-releases/",
        "https://github.com/django/django/commit/1eafa1a80f1363283f89208ba4499ed54e35f085",
        "https://github.com/django/django/commit/4353dfb56f8ba3a6fccc4bdd7f2ef2fbee3aa638",
        "https://github.com/django/django/commit/62ef9d40cf4ea75f16518436b44b8ab2515340df",
        "https://github.com/django/django/commit/75d401a1491e04a907ed745c128836d51c982c0f"
      ],
      "provider_metadata": {
        "cpes": [
          "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*"
        ],
        "severity": "Medium"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-15830",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 120652,
  "published_at": "2026-08-19T08:39:53.489+00:00"
}