CVE-2026-15830: Potential denial-of-service vulnerability via nested geometry collections
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the django.contrib.gis.forms.GeometryField form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok for reporting this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15830?
The severity of CVE-2026-15830 is classified as medium with a score of 5.3.
How do I fix CVE-2026-15830?
To fix CVE-2026-15830, upgrade to Django version 5.2.17 or 6.0.8 or later.
What type of vulnerability is CVE-2026-15830?
CVE-2026-15830 is a potential denial-of-service vulnerability affecting GeoDjango's handling of nested geometry collections.
Which versions of Django are affected by CVE-2026-15830?
Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8 are affected by CVE-2026-15830.
What is the potential impact of CVE-2026-15830?
The potential impact of CVE-2026-15830 is a denial-of-service condition when processing deeply nested geometry collections.