Django releases security updates for six CVEs
Django security releases address multiple vulnerabilities including CVE-2026-108147, CVE-2026-111211, CVE-2026-111362, CVE-2026-113593, CVE-2026-113733, and CVE-2026-114582.
40
CVE-2026-111362
SSRF in Django OGRGeometry GeoJSON parser
- CVSS 4.0
- 6.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Django's OGRGeometry does not restrict external CRS definitions in GeoJSON input. Remote attackers can trigger SSRF to attacker-selected destinations via crafted crs members. This affects Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. Unsupported earlier series may also be vulnerable.
What to do: Upgrade Django to 6.1.3, 6.0.10 or 5.2.19.
| Product | Affected | Fixed in |
|---|---|---|
| Django | 6.1 before 6.1.3, 6.0 before 6.0.10, 5.2 before 5.2.19 | 6.1.3, 6.0.10, 5.2.19 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.gdal.OGRGeometry` does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause server-side requests to attacker-selected destinations via crafted crs members. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Submersion Security Research Team for reporting this issue.
- Weakness
- CWE-918
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X