SB2026080601 - SUSE update for python-Django
Published: August 6, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-15307)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to write files to disk or issue network requests as the Django process user.
The vulnerability exists due to improper input validation in spatial lookups when processing lookup values that are passed to GDALRaster. A remote user can supply a specially crafted lookup value to write files to disk or issue network requests as the Django process user.
The issue was reachable through the admin changelist for staff users with view permissions on any registered model containing a spatial field.
2) Resource exhaustion (CVE-ID: CVE-2026-15337)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled memory consumption in django.utils.translation.check_for_language() when checking many distinct, very long language codes. A remote attacker can send crafted POST data containing many distinct long language values to cause a denial of service.
The language value reaches this function through the django.views.i18n.set_language() view, which is not active by default, and the memory consumption is bounded by request size and cache entry limits.
3) Uncontrolled Recursion (CVE-ID: CVE-2026-15830)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of deeply nested input in GEOSGeometry when parsing deeply nested GEOMETRYCOLLECTION objects. A remote attacker can supply a crafted geometry input to cause a denial of service.
Lookups against spatial fields and the GeometryField form field were also affected. GeoJSON inputs were not affected.
4) Cross-site scripting (CVE-ID: CVE-2026-15920)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary script in a user's browser.
The vulnerability exists due to improper neutralization of input during web page generation in admin URLField rendering when displaying stored URLField values as clickable links. A remote user can store a URLField value with a dangerous scheme to execute arbitrary script in a user's browser.
The issue affected changelist views and read-only fields rendered through display_for_field.
Remediation
Install update from vendor's website.