Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-08-04 | 1 | General1 |
| 2026-08-05 | 1 | Patch1 |
| 2026-08-10 | 1 | General1 |
| 2026-09-16 | 1 | General1 |
| 2026-09-23 | 1 | General1 |
I really do think harnesses are falling away, but mines still going for now, forgot to add this to the list from Aug 04 CVE-2026-15830 -- https://www.djangoproject.com/weblog/2026/aug/04/security-releases/
Post summary
The text references the CVE-2026-15830 on a Django security releases page but offers no further technical or exploit details.
CVE-2026-15830 My lil robot still going on! https://t.co/WbRKXmpDo6
Post summary
The tweet references CVE-2026-15830 and includes a link, but provides no concrete information about PoC, exploit, or mitigation.
Django patched four critical vulnerabilities across admin and spatial query handling. CVE-2026-15920 tightens URL validation in display_for_field() to prevent malicious admin links. CVE-2026-15307 blocks raster strings and dicts in spatial lookups. CVE-2026-15830 mitigates DoS via nested geometry collections. CVE-2026-15337 hardens check_for_language() against DoS. All four added to the security archive. If you're running Django in production with admin or GIS enabled, patch today. #django https://repojournal.com/showcase/django/2026-08-05/django-patches-four-critical-vulnerabilities-in-admin-and-spatial-queries
Post summary
The post announces that Django has released patches for four critical admin and GIS-related CVEs and urges production users to apply them.
Django Fellow Report - Jacob Jacob reviewed six Django pull requests and authored changes covering GEOS 3.10 support removal and expanded WKT depth-check coverage related to CVE-2026-15830. He also worked on security reports and Django coordination... https://forum.djangoproject.com/t/django-fellow-report-jacob-2026/43851/39
Post summary
The text references CVE-2026-15830 alongside Django fellow Jacob's work on GEOS 3.10 support removal and WKT depth-check coverage, but lacks any proof of concept, exploit code, active exploitation claims, patches, technical vulnerability details, or false positive assertions.
[Django Fellow Reports] Django Fellow Report - Jacob Jacob reviewed six Django pull requests and authored changes covering GEOS 3.10 support removal and expanded WKT depth-check coverage related to CVE-2026-15830. https://forum.djangoproject.com/t/django-fellow-report-jacob-2026/43851/39
Post summary
The Django Fellow report by Jacob highlights development changes related to CVE-2026-15830, such as GEOS support removal and WKT depth-check coverage, but lacks specific details on vulnerabilities, exploits, or patches.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | djangoproject | django | - | - | - |