CyberRota Analysis
AI-GeneratedDjango versions 5.2 prior to 5.2.17 and 6.0 prior to 6.0.8 are vulnerable to a denial-of-service attack due to unbounded recursion when parsing deeply nested `GEOMETRYCOLLECTION` objects in GeoDjango, potentially leading to a segmentation fault in the GEOS library. This issue affects spatial field lookups and the `GeometryField` form field, making it critical for applications utilizing these features to prioritize updates. Organizations using affected Django versions, especially those leveraging GeoDjango for spatial data processing, should address this vulnerability promptly to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.