CVE-2026-15830 Djangoproject CVE debrief

Who should care

Developers and administrators using GeoDjango functionality in Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8 should be aware of this potential denial-of-service vulnerability and take steps to mitigate it. Affected operators, platforms, vulnerability-management, and security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The vulnerability is caused by unbounded recursion and a segmentation fault in the underlying GEOS library when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB. Spatial field lookups and the django.contrib.gis.forms.GeometryField form field are also affected. This issue affects Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8.

Defensive priority

Medium priority due to potential denial-of-service vulnerability in widely used GeoDjango functionality.

Recommended defensive actions

• Apply official patches for affected Django versions
• Review and update GeoDjango usage to prevent potential denial-of-service
• Monitor for and address potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was reported by Andrew MacPherson and kimchunbok_. Official patches are available for affected Django versions. Further verification is recommended to confirm affected scope and severity. Defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Official resources