CVE-2026-111362: Server-side request forgery via crs member of GeoJSON geometries

Q: Which deployments are exposed to this issue?

Deployments using Django 6.1 before 6.1.3, 6.0 before 6.0.10, or 5.2 before 5.2.19 are affected when they process GeoJSON input through django.contrib.gis.gdal.OGRGeometry. Unsupported series such as 5.1.x, 5.0.x, and 4.2.x were not evaluated and may also be affected.

Q: What must an attacker provide to trigger the server-side request?

An attacker needs to submit crafted GeoJSON containing a crs member with an external coordinate reference system definition. No authentication or user interaction is required according to the provided vector.

Q: What is the impact of successful exploitation?

The vulnerable server can be induced to make requests to destinations selected by the attacker. The reported impact is limited to confidentiality; integrity and availability impacts are not indicated.

Q: What versions should be used to remediate the issue?

Upgrade Django 6.1 to 6.1.3 or later, Django 6.0 to 6.0.10 or later, or Django 5.2 to 5.2.19 or later. For unsupported Django branches, the available information does not establish whether a fix exists.

Published Nov 3, 2026

Updated

[Server-side request forgery via crs member of GeoJSON geometries]

Other sources

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.OGRGeometry does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause server-side requests to attacker-selected destinations via crafted crs members. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Submersion Security Research Team for reporting this issue.

— MITRE

Affected Software

13 affected componentsFixes available

debian/python-django*

debian/python-django<=3:3.2.25-0+deb12u3, <=3:3.2.25-0+deb12u6, <=3:4.2.28-0+deb13u2, <=3:4.2.28-0+deb13u1, <=3:5.2.17-2, <=3:5.2.18-2

ubuntu/python-django*

alpine/py3-django<5.2.19-r0

5.2.19-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/py3-django to a version that resolves this vulnerability.
Fixed in 5.2.19-r0
Upgrade
Upgrade Django to a version that resolves this vulnerability.
Fixed in 6.1.3
Upgrade
Upgrade Django to a version that resolves this vulnerability.
Fixed in 6.0.10
Upgrade
Upgrade Django to a version that resolves this vulnerability.
Fixed in 5.2.19

Event History

Nov 3, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·03:42 PM

Data Sourced

via MITRE·03:42 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·03:42 PM

Weakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Django 6.1 before 6.1.3, 6.0 before 6.0.10, or 5.2 before 5.2.19 are affected when they process GeoJSON input through django.contrib.gis.gdal.OGRGeometry. Unsupported series such as 5.1.x, 5.0.x, and 4.2.x were not evaluated and may also be affected.

What must an attacker provide to trigger the server-side request?

An attacker needs to submit crafted GeoJSON containing a crs member with an external coordinate reference system definition. No authentication or user interaction is required according to the provided vector.

What is the impact of successful exploitation?

The vulnerable server can be induced to make requests to destinations selected by the attacker. The reported impact is limited to confidentiality; integrity and availability impacts are not indicated.

What versions should be used to remediate the issue?

Upgrade Django 6.1 to 6.1.3 or later, Django 6.0 to 6.0.10 or later, or Django 5.2 to 5.2.19 or later. For unsupported Django branches, the available information does not establish whether a fix exists.

CVE-2026-111362: Server-side request forgery via crs member of GeoJSON geometries

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the server-side request?

What is the impact of successful exploitation?

What versions should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the server-side request?

What is the impact of successful exploitation?

What versions should be used to remediate the issue?