AIKIDO-2026-971295
Django is vulnerable to Denial of Service (DoS)
59
CVE Score
Medium
Denial of Service (DoS)
TL;DR
GeoDjango's GEOSGeometry parses text and binary geometry input, including nested GEOMETRYCOLLECTION objects. Deeply nested collections trigger unbounded recursion in the underlying GEOS library and cause a segmentation fault that crashes the process. The fix enforces a maximum of 198 nested geometry collections for the WKT and WKB formats.
How do I fix this?
Upgrade the Django library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application parses untrusted geometry input through GeoDjango.
Package
Versions
5.2.0 - 5.2.16
Fixed in 5.2.176.0.0 - 6.0.7
Fixed in 6.0.8Background info
Django is vulnerable to Denial of Service (DoS) in versions 5.2.0 - 5.2.16 and 6.0.0 - 6.0.7.
Links
Fix Commits
github.com/django/django/commit/1eafa1a80f1363283f89208ba4499ed54e35f085github.com/django/django/commit/4353dfb56f8ba3a6fccc4bdd7f2ef2fbee3aa638github.com/django/django/commit/62ef9d40cf4ea75f16518436b44b8ab2515340dfgithub.com/django/django/commit/6af5da31775417c610dbf9c3f1b5b8333d42daf6github.com/django/django/commit/75d401a1491e04a907ed745c128836d51c982c0fgithub.com/django/django/commit/9e4a3f186b6b07b483bfd9195ea06734663fcd06github.com/django/django/commit/ba80833fa656dd09660b97c4429331067db1b080github.com/django/django/commit/d2e59b77fe18de318a8272c2a7bbc798d84d1d0dOther
docs.djangoproject.com/en/5.2/releases/5.2.17/docs.djangoproject.com/en/dev/releases/security/groups.google.com/g/django-announcedjangoproject.com/weblog/2026/aug/04/security-releases/
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.