Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-04T15:48:34 django: Django: Denial of Service via parsing deeply nested geometry collections 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CWE-606

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.

A flaw was found in Django's GeoDjango component. A remote attacker could exploit this vulnerability by supplying specially crafted, deeply nested geometry collection objects in well-known text (WKT), well-known binary (WKB), or hex-encoded WKB formats. This triggers unbounded recursion and a segmentation fault in the underlying GEOS library, leading to a denial of service (DoS) for applications using spatial field lookups or the GeometryField form field.

This Moderate impact denial-of-service vulnerability in Django affects Red Hat products utilizing GeoDjango, such as Red Hat Ansible Automation Platform and Red Hat OpenStack Platform. Processing specially crafted, deeply nested geometry collections in well-known text (WKT), well-known binary (WKB), or hex-encoded WKB formats can lead to unbounded recursion and a segmentation fault in the underlying GEOS library, causing service disruption. To mitigate this issue, configure Django applications utilizing GeoDjango to restrict the maximum depth of nested geometry collections. This can be achieved by setting the `max_geom_collections` argument on `GEOSGeometry` objects, spatial form fields, or model fields that handle WKT or WKB inputs. Implementing this configuration change may necessitate application-level adjustments and a restart of the Django application to ensure the new limits are enforced. Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-24/controller-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-24/eda-controller-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-24/hub-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-24/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/ansible-dev-tools-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/controller-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/eda-controller-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/gateway-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/hub-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/ansible-dev-tools-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/gateway-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/hub-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/aap-cloud-billing-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/ansible-dev-tools-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/gateway-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/hub-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/metrics-service-rhel9 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform/automation-dashboard-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-tech-preview/metrics-service-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred automation-controller Red Hat Ansible Automation Platform 2 Fix deferred python-django Red Hat Discovery 2 Fix deferred discovery/discovery-server-rhel9 Red Hat OpenStack Platform 16.2 Out of support scope python-django20 Red Hat OpenStack Platform 17.1 Out of support scope python-django Red Hat OpenStack Platform 18.0 Fix deferred python-django Red Hat Satellite 6 Fix deferred python-django Red Hat Satellite 6 Fix deferred satellite-capsule:el8/python-django Red Hat Satellite 6 Fix deferred satellite/iop-advisor-backend-rhel9 Red Hat Update Infrastructure 4 for Cloud Providers Out of support scope python-django Red Hat Update Infrastructure 5 Fix deferred rhui5/rhua-rhel9 Self-service automation portal 2 Fix deferred ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-15830 https://nvd.nist.gov/vuln/detail/CVE-2026-15830 https://docs.djangoproject.com/en/dev/releases/security/ https://github.com/django/django/commit/6af5da31775417c610dbf9c3f1b5b8333d42daf6 https://github.com/django/django/commit/9e4a3f186b6b07b483bfd9195ea06734663fcd06 https://github.com/django/django/commit/ba80833fa656dd09660b97c4429331067db1b080 https://github.com/django/django/commit/d2e59b77fe18de318a8272c2a7bbc798d84d1d0d https://groups.google.com/g/django-announce https://www.djangoproject.com/weblog/2026/aug/04/security-releases/