Django Urges Immediate Upgrade to 6.0.8 and 5.2.17 After Four Security Fixes

The Django development team has released Django 6.0.8 and Django 5.2.17 to fix four security vulnerabilities affecting supported versions of the Python web framework.

Developers and administrators are urged to upgrade as soon as possible, especially where Django GIS features or the built-in admin interface are exposed to staff users.

The most severe issue, tracked as CVE-2026-15307, is rated high severity. It affects Django spatial lookups that process raster-related values through GDALRaster.

Previously, spatial lookups could accept string and dictionary values when they represented rasters. Depending on the selected raster driver, a malicious value could trigger a file write on the server or make a network request using the permissions of the Django process.

Django Patches Four Security Flaws

In certain environments, the file-write behavior could potentially lead to remote code execution. The issue was especially relevant to Django admin changelists, where staff users with view permissions could use filtering on registered models containing spatial fields.

Django now blocks dictionary values and strings that are not valid GEOSGeometry objects from being used in spatial lookups. This security change may affect applications that relied on these input types.

Django stated that model field assignments remain unchanged and can still accept them. Developers handling untrusted spatial data should validate it before use and review Django’s raster security guidance before restoring similar functionality in custom code.

CVE-2026-15337 addresses a low-severity denial-of-service risk in django.utils.translation.check_for_language(). The function could store a large number of distinct and excessively long language codes in an in-memory cache.

An attacker might send long values through POST requests to the optional set_language() view, gradually consuming memory.

The memory impact was limited by Django request-size settings and a maximum cache-entry count. However, the update now rejects language codes longer than 500 characters before they reach the cached lookup, reducing unnecessary memory consumption.

Another denial-of-service flaw, CVE-2026-15830, affects applications using geographic geometry processing. Deeply nested GEOMETRYCOLLECTION objects could cause a segmentation fault in the underlying GEOS library.

This could allow an attacker to disrupt a Django application if crafted geometry input is passed to spatial field lookups or a GeometryField form field.

The fixes enforce a maximum of 198 nested geometry collections for well-known text input. For well-known binary input, Django limits the total number of geometry collections to 198.

Developers who require a different threshold can use the new max_geom_collections setting available in GEOSGeometry, as well as in relevant form fields and model fields. GeoJSON inputs are unaffected because GDAL parses them.

The fourth issue, CVE-2026-15920, is a moderate-severity stored cross-site scripting risk in Django admin views. URLField values were rendered as clickable links in changelists and read-only admin fields without first confirming that the URL used a safe scheme.

A stored value using a dangerous scheme could therefore appear as an active link. Django now validates URLField values with URLValidator before rendering them as links. Invalid values are displayed as plain text instead.

The fixes are also applied to Django’s main branch and the Django 6.1 release candidate branch. Organizations should promptly update Django deployments, test spatial lookup compatibility, and review admin access controls and input validation practices.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.