EUVD-2026-52749
GHSA-q238-5cxm-5c9h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible form/API input path, no privileges required for public GeometryField forms, and impact is worker process crash (high availability, no C/I impact).
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Blast Radius
ecosystem impact- 16 pypi packages depend on django (16 direct, 0 indirect)
Ecosystem-wide dependent count for version 6.0.
Description PRE-NVD
AnalysisAI
Denial-of-service via recursive GEOMETRYCOLLECTION parsing crashes Django processes through a segmentation fault in the underlying GEOS library. Django's GEOSGeometry class, GeometryField form field, and spatial field lookups in versions 5.2, 6.0, 6.1 (RC), and main are all affected when processing WKT or WKB input containing deeply nested or excessively numerous GEOMETRYCOLLECTION objects. No public exploit code or active exploitation has been identified at time of analysis; the Django team rated this 'moderate' severity and issued fixed releases Django 5.2.17 and 6.0.8 on August 4, 2026.
Technical ContextAI
The vulnerability resides in Django's GeoDjango GIS module, specifically in the GEOSGeometry class which wraps the GEOS (Geometry Engine - Open Source) C library for spatial data parsing. GEOS processes WKT and WKB geometry formats recursively; when GEOMETRYCOLLECTION nesting depth or total count exceeds safe thresholds, GEOS enters unbounded recursion leading to a stack exhaustion and segmentation fault - consistent with CWE-674 (Uncontrolled Recursion) or CWE-400 (Uncontrolled Resource Consumption). The flaw propagates through GeometryField form fields and spatial ORM lookups, meaning any Django view or admin interface that passes user-supplied WKT/WKB to GEOSGeometry is an attack surface. GeoJSON inputs are explicitly not affected because they are parsed by GDAL rather than GEOS. No CPE string or CWE identifier was provided in the source data; affected products are identified from the Django advisory text directly.
RemediationAI
Upgrade to Django 5.2.17 or Django 6.0.8 immediately; these releases enforce a maximum depth of 198 GEOMETRYCOLLECTION objects for WKT and a total count of 198 (across both breadth and depth) for WKB. Release tarballs and wheels are available at https://www.djangoproject.com/download/5.2.17/tarball/ and https://www.djangoproject.com/download/6.0.8/tarball/ with PGP-verified checksums. If immediate upgrade is not possible, consider restricting geometry form field and API inputs to GeoJSON format only (parsed by GDAL and not affected), or add application-level validation to reject WKT/WKB inputs that exceed a reasonable nesting depth before passing them to GEOSGeometry. The patched versions also expose a new max_geom_collections argument on GEOSGeometry, the form field, and the model field, allowing operators to customize the threshold beyond the default of 198.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today