onyx --cves cve-2026-15830
CVE-2026-15830
- score
- 0.1
- cvss
- 5.3
- epss
- 1.1%
- published
- 2026-08-04
- kev added
- —
- first seen
Django 5.2 < 5.2.17 and 6.0 < 6.0.8 contain a denial-of-service caused by unbounded recursion in GeoDjango's GEOSGeometry when parsing deeply nested GEOMETRYCOLLECTION objects, letting attackers cause application crashes, exploit requires crafted geometry input.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- First advisory — Django weblog Django security releases issued: 6.1.2, 6.0.9, and 5.2.18
- Tracked by Onyx
Advisories
0 feeds this week
Weaknesses
References 11
- https://www.djangoproject.com/weblog/2026/aug/04/security-releases/
- https://github.com/django/django/commit/62ef9d40cf4ea75f16518436b44b8ab2515340df
- https://github.com/django/django/commit/75d401a1491e04a907ed745c128836d51c982c0f
- https://github.com/django/django/commit/ba80833fa656dd09660b97c4429331067db1b080
- https://github.com/django/django/commit/d2e59b77fe18de318a8272c2a7bbc798d84d1d0d
- https://github.com/django/django/commit/1eafa1a80f1363283f89208ba4499ed54e35f085
- https://github.com/django/django/commit/4353dfb56f8ba3a6fccc4bdd7f2ef2fbee3aa638
- https://docs.djangoproject.com/en/dev/releases/security/
- https://github.com/django/django/commit/6af5da31775417c610dbf9c3f1b5b8333d42daf6
- https://github.com/django/django/commit/9e4a3f186b6b07b483bfd9195ea06734663fcd06
- https://groups.google.com/g/django-announce