CVE-2026-15830: Potential denial-of-service vulnerability via nested geometry collections
Vulnerability summary
CVE-2026-15830 is a medium (CVSS 6.9) Uncontrolled Recursion vulnerability in djangoproject django. EPSS estimates a 1.11% chance of exploitation in the next 30 days, higher than 66% of scored vulnerabilities.
Not severe (CVSS 6.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 5Timeline
- 04-08-2026PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.
CVSS metrics
11 scores · 7 sources · 2 versions- OSV · PypiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · AlpineEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
1.11%
Chance of exploitation in the next 30 days
Percentile
66%
Versus all other CVEs
30-day change
Increase +0.35 pp
From 0.76% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard12 products
- authentik-2025.12All versions (No fix recorded)
- authentik-2026.2< 2026.2.7-r3
- authentik-2026.5< 2026.5.7-r7
- authentik-fips-2025.12All versions (No fix recorded)
- authentik-fips-2026.2All versions (No fix recorded)
Alpine1 product
- py3-django< 5.2.17-r0
Debian1 product
- python-djangoAll versions (No fix recorded) | < 3:5.2.17-1
Djangoproject1 product
- django≥ 6.0, < 6.0.9 | ≥ 5.2, < 5.2.18 | < 5.2.17 | ≥ 6.0, < 6.0.8
PyPI1 product
- django≥ 6.0, < 6.0.8 | < 5.2.17 | ≥ 6.0a1, < 6.0.8 | ≥ 6.1a1, < 6.1.1
Ubuntu1 product
- python-djangoAll versions (No fix recorded)
6 vendors · 17 products
References
24 linksShow all 24 references
- github.com/django/djangoPACKAGE
- pypi.org/project/Django/PACKAGE