Uncontrolled Recursion in Django - CVE-2026-15830
Published: August 5, 2026
Vulnerability identifier: #VU140944
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-15830
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of deeply nested input in GEOSGeometry when parsing deeply nested GEOMETRYCOLLECTION objects. A remote attacker can supply a crafted geometry input to cause a denial of service.
Lookups against spatial fields and the GeometryField form field were also affected. GeoJSON inputs were not affected.
Affected software
Django
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Package Hub 15
openSUSE Leap
python311-Django
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Package Hub 15
openSUSE Leap
python311-Django
How to mitigate CVE-2026-15830
Install security update from vendor's website.
Django - addressed in versions 5.2.17, 6.0.8
python311-Django - update to 4.2.11-150600.3.65.1
python311-Django - update to 4.2.11-150600.3.65.1