{
  "cveId": "CVE-2026-15830",
  "url": "https://patchblox.com/security/cve/CVE-2026-15830",
  "summary": "CVE-2026-15830 is fixed in 2 products on 1 platform, first by SUSE-SU-2026:3503-1, released August 5, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "python-django: An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18",
  "description": "An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango\u0027s \u0060django.contrib.gis.geos.GEOSGeometry\u0060 is subject to a potential denial-of-service when parsing deeply nested \u0060GEOMETRYCOLLECTION\u0060 objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the \u0060django.contrib.gis.forms.GeometryField\u0060 form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.",
  "published": "2026-08-04T17:16:46Z",
  "severity": "",
  "epss": 0.01113,
  "epssPercentile": 0.66218,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "5.2.4-bp160.11.1",
      "fix": "OPENSUSE-SU-2026:21543-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21543-1",
      "released": "2026-08-06T14:20:58Z"
    },
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "sles 15.7",
      "fixedVersion": "4.2.11-150600.3.65.1",
      "fix": "SUSE-SU-2026:3503-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3503-1",
      "released": "2026-08-05T12:49:57Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 14",
      "fixedVersion": "3:5.2.17-1",
      "fix": "DEBIAN-CVE-2026-15830",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-15830",
      "released": "2026-08-22T23:48:30Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}