AIKIDO-2026-971295
Django is vulnerable to Denial of Service (DoS)
59
Medium Risk
This Affects:
DjangoTL;DR
GeoDjango's GEOSGeometry parses text and binary geometry input, including nested GEOMETRYCOLLECTION objects. Deeply nested collections trigger unbounded recursion in the underlying GEOS library and cause a segmentation fault that crashes the process. The fix enforces a maximum of 198 nested geometry collections for the WKT and WKB formats.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application parses untrusted geometry input through GeoDjango.
Background info
Django is vulnerable to Denial of Service (DoS) in versions 5.2.0 - 5.2.16 and 6.0.0 - 6.0.7.
How to fix this
Upgrade the Django library to the patch version.
Links
Fix Commits
github.com/django/django/commit/6af5da31775417c610dbf9c3f1b5b8333d42daf6github.com/django/django/commit/9e4a3f186b6b07b483bfd9195ea06734663fcd06github.com/django/django/commit/ba80833fa656dd09660b97c4429331067db1b080github.com/django/django/commit/d2e59b77fe18de318a8272c2a7bbc798d84d1d0dOther
docs.djangoproject.com/en/5.2/releases/5.2.17/docs.djangoproject.com/en/dev/releases/security/groups.google.com/g/django-announcedjangoproject.com/weblog/2026/aug/04/security-releases/
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant