Denial-of-Service in Django GEOSGeometry Parsing

Executive Summary

This vulnerability is a denial-of-service issue in Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8. It occurs when GeoDjango's GEOSGeometry parses deeply nested GEOMETRYCOLLECTION objects in WKT, WKB, or hex-encoded WKB formats, causing unbounded recursion and a segmentation fault in the GEOS library. Spatial field lookups and GeometryField form fields are also affected.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8, specifically when parsing deeply nested GEOMETRYCOLLECTION objects. To detect it, check your Django version with `python -c "import django; print(django.get_version())"`. If you are running an affected version, inspect any code or inputs that process spatial data via GEOSGeometry or GeometryField.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause system crashes or unresponsiveness when processing malicious or malformed spatial data. It may lead to denial-of-service conditions, disrupting services that rely on Django's GeoDjango functionality.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical DoS issue in Django's GIS components. However, unpatched systems could experience service disruptions, potentially impacting availability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Django to version 5.2.17 or later, or 6.0.8 or later. If upgrading is not immediately possible, avoid processing untrusted spatial data inputs, particularly GEOMETRYCOLLECTION objects, until patched.

Useful 0 Not Useful 0