CVE-2026-15830

Aliases:UBUNTU-CVE-2026-15830DEBIAN-CVE-2026-15830PYSEC-2026-3717BIT-django-2026-15830
Advisory lineage Upstream: 0 Downstream: 6
Analyzed
Published: 04 Aug 2026, 15:48
Last modified:04 Aug 2026, 17:21

Vulnerability Summary

Overall Risk (default)
medium
28/100
CVSS Score
6.9 MEDIUM
v4.0 (cve.org)
EPSS Score
1.26% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

04 Aug 2026, 15:48
Published
Vulnerability first disclosed
04 Aug 2026, 17:21
Last Modified
Vulnerability information updated

Description

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.

CVSS Metrics

  • v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  • v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Trends

Current EPSS score: 1.26%• Percentile: 68%

Techniques & Countermeasures

  • CWE-674•Uncontrolled Recursion

    The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected Systems

  • debian•python-django

    all | all | all | all | < 3:5.2.17-1

  • ubuntu•python-django

    all | all | all | all

  • djangoproject•django

    ≥ 5.2, < 5.2.17 | < 5.2.17 | ≥ 6.0, < 6.0.8

  • PyPI•django

    ≥ 6.0, < 6.0.8

References (10)