6.9
CVE-2026-15830
- EPSS 0.52%
- Veröffentlicht 04.08.2026 15:48:34
- Zuletzt bearbeitet 18.08.2026 16:30:33
- CVE-Watchlists
- Unerledigt
Potential denial-of-service vulnerability via nested geometry collections
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Djangoproject ≫ Django Version < 5.2.17
Djangoproject ≫ Django Version >= 6.0 < 6.0.8
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.52% | 0.414 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 | 6.9 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
|
CWE-674 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://docs.djangoproject.com/en/dev/releases/security/
https://groups.google.com/g/django-announce
https://www.djangoproject.com/weblog/2026/aug/04/security-releases/
https://github.com/django/django/commit/d2e59b77fe18de318a8272c2a7bbc798d84d1d0d
https://github.com/django/django/commit/9e4a3f186b6b07b483bfd9195ea06734663fcd06
https://github.com/django/django/commit/6af5da31775417c610dbf9c3f1b5b8333d42daf6
https://github.com/django/django/commit/ba80833fa656dd09660b97c4429331067db1b080