ALPINE-CVE-2026-111362: Medium severity alpine/py3-django vulnerability
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.OGRGeometry does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause server-side requests to attacker-selected destinations via crafted crs members. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Submersion Security Research Team for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 5.2.19-r0 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 6.1.3 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 6.0.10 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.2.19
Event History
Frequently Asked Questions
What deployments are exposed to this issue?
Deployments using django.contrib.gis.gdal.OGRGeometry to process GeoJSON input are exposed if they run Django 6.1 before 6.1.3, 6.0 before 6.0.10, or 5.2 before 5.2.19. Unsupported series, including 5.1.x, 5.0.x, and 4.2.x, were not evaluated and may also be affected.
What must an attacker be able to do to exploit it?
An attacker needs to submit crafted GeoJSON that is processed by OGRGeometry. The GeoJSON must include a crs member containing an external coordinate reference system definition that points to an attacker-selected destination.
What is the likely impact of successful exploitation?
Successful exploitation can cause the server to make requests to destinations selected by the attacker. The stated impact is limited to confidentiality effects on the vulnerable system and integrity effects on a subsequent system.
What should be done if an immediate upgrade is not possible?
The provided information does not specify a workaround. As an exposure-reduction measure based on the affected input path, avoid processing untrusted GeoJSON with OGRGeometry, particularly GeoJSON containing crs members, until an update can be applied.