An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 2
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Djangoproject Django
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
|
— |
5.2.17
|
|
Djangoproject Django
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
|
6.0
|
6.0.8
|
References 7
https://docs.djangoproject.com/en/dev/releases/security/
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
https://github.com/django/django/commit/6af5da31775417c610dbf9c3f1b5b8333d42daf6
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
https://github.com/django/django/commit/9e4a3f186b6b07b483bfd9195ea06734663fcd06
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
https://github.com/django/django/commit/ba80833fa656dd09660b97c4429331067db1b080
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
https://github.com/django/django/commit/d2e59b77fe18de318a8272c2a7bbc798d84d1d0d
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
https://groups.google.com/g/django-announce
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
https://www.djangoproject.com/weblog/2026/aug/04/security-releases/
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92