CVE-2026-15830: 
Django vulnerability analysis and mitigation

CVE-2026-15830 is a denial-of-service vulnerability in Django's GeoDjango component (django.contrib.gis.geos.GEOSGeometry) caused by unbounded recursion when parsing deeply nested GEOMETRYCOLLECTION objects. It affects Django 5.2 before 5.2.17 and Django 6.0 before 6.0.8; earlier unsupported series (5.1.x, 5.0.x, 4.2.x) were not evaluated but may also be affected. The vulnerability was disclosed on August 4, 2026, and was reported by Andrew MacPherson and kimchunbok_. It carries a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (Github Advisory, Django Security Releases).

The root cause is uncontrolled recursion (CWE-674) combined with unchecked input for loop conditions (CWE-606) in the GEOS library's geometry parsing routines invoked by GEOSGeometry. When a specially crafted GEOMETRYCOLLECTION with excessive nesting depth is supplied as WKT, WKB, or hex-encoded WKB, the parser recurses without bound, ultimately triggering a segmentation fault in the underlying C-based GEOS library. The vulnerability is reachable through spatial field lookups on GeoDjango model fields and through the django.contrib.gis.forms.GeometryField form field, meaning any endpoint that accepts user-supplied geometry data is a potential attack surface. No authentication or special privileges are required, and the attack is network-accessible with low complexity (Github Advisory, Django Commit d2e59b7).

Successful exploitation causes the Django application process to crash via a segmentation fault in the GEOS library, resulting in a denial of service. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Because the crash occurs at the native library level, it may terminate the worker process entirely, making the application unavailable until it is restarted, and repeated attacks can sustain an outage (Github Advisory, Django Security Releases).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Github Advisory). The attack is automatable (NVD SSVC: automatable=yes) and requires no authentication, making it straightforward to trigger at scale against exposed GeoDjango endpoints. The EPSS score is approximately 0.52% (42nd percentile), indicating a relatively low but non-negligible probability of exploitation within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no threat actor attribution has been reported.

1. Reconnaissance: Identify Django applications using GeoDjango (e.g., applications with spatial API endpoints, map-based features, or geometry form fields) by examining HTTP responses, JavaScript map libraries, or API documentation.
2. Identify target endpoint: Locate any endpoint that accepts geometry input — such as a REST API accepting WKT/WKB geometry parameters, a form with a GeometryField, or a spatial filter query parameter.
3. Craft malicious payload: Construct a deeply nested GEOMETRYCOLLECTION in WKT format, for example: GEOMETRYCOLLECTION(GEOMETRYCOLLECTION(GEOMETRYCOLLECTION(...))) with hundreds or thousands of nesting levels, or the equivalent WKB/hex-encoded WKB representation.
4. Submit payload: Send the crafted geometry string to the target endpoint via an HTTP request (e.g., POST body, query parameter, or JSON field).
5. Trigger crash: The GEOSGeometry parser passes the input to the GEOS library, which recurses without bound and causes a segmentation fault, crashing the Django worker process and making the application unavailable (Github Advisory, Django Commit d2e59b7).

• Logs: Django application logs showing abrupt worker process termination or segmentation fault errors originating from GEOS library calls; web server logs (e.g., Gunicorn, uWSGI) recording 502/503 errors coinciding with requests containing large geometry payloads.
• Network: HTTP requests to GeoDjango endpoints containing unusually large or deeply nested GEOMETRYCOLLECTION strings in WKT, WKB, or hex-encoded WKB format in request bodies or parameters.
• Process: Unexpected termination of Django worker processes (e.g., python manage.py runserver, Gunicorn workers) with exit codes indicating a signal (SIGSEGV); repeated process restarts by process managers (systemd, supervisor) in a short time window.

Upgrade Django to version 5.2.17 or 6.0.8 (or later), which introduce a max_geom_collections argument on geometry model and form fields that limits recursion depth (WKT) or total collection count (WKB) before input reaches the GEOS library (Django Security Releases, Django Commit d2e59b7). For unsupported versions (5.1.x, 5.0.x, 4.2.x), evaluate exposure and consider implementing application-level input validation to reject geometry inputs exceeding a defined nesting depth or size before they reach GEOSGeometry. As an additional defense-in-depth measure, restrict access to geometry-accepting endpoints to authenticated or trusted users where possible.

The Django project issued a security advisory on August 4, 2026, crediting Andrew MacPherson and kimchunbok_ for the report (Django Security Releases). Multiple security news outlets covered the release, including The Hacker News, GBHackers, CyberPress, and CyberSecurityNews, framing it as part of a broader Django security update addressing four vulnerabilities. SUSE issued a security update (SUSE-SU-2026:3503-1) for its python-django packages, and openSUSE followed with corresponding advisories, indicating prompt uptake by Linux distributions.