Hi,

The following vulnerabilities were published for python-django.

CVE-2026-15307[0]:
| An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before
| 6.0.8. GeoDjango spatial lookups optimistically parse the right-
| hand-side value as a raster by passing it to the
| `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in
| a spatial lookup against a `GeometryField` or `RasterField` reaches
| this constructor, including untrusted input, for example a spatial-
| field filter submitted through the Django admin changelist query
| string by a staff user with view permission. A `dict`, or a `str`
| holding its JSON representation, is opened in write mode regardless
| of the constructor's `write=False` default, allowing a file with an
| attacker-chosen name and contents to be written through a file-
| backed GDAL driver. Any other `str` is treated as a datasource,
| allowing an outbound network request through a GDAL virtual
| filesystem handler. Writing a file to a location later imported by
| the application can result in remote code execution. Earlier,
| unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not
| evaluated and may also be affected. Django would like to thank Bence
| Nagy, localhost-detect, and kimchunbok_ for reporting this issue.


CVE-2026-15337[1]:
| An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before
| 6.0.8. `django.utils.translation.check_for_language()` is subject to
| a potential denial-of-service attack when given many distinct, very
| long language codes, which are retained as keys in an in-memory
| cache and consume process memory. Such codes reach the function
| through the `django.views.i18n.set_language()` view, which is not
| routed by default. The consumed memory is bounded, since request
| data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting
| (default 2.5 MB) and the cache holds a fixed maximum number of
| entries. Earlier, unsupported Django series (such as 5.1.x, 5.0.x,
| and 4.2.x) were not evaluated and may also be affected. Django would
| like to thank Jaeyoung Jang for reporting this issue.


CVE-2026-15830[2]:
| An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before
| 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject
| to a potential denial-of-service when parsing deeply nested
| `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT),
| well-known binary (WKB), or hex-encoded WKB, which triggers
| unbounded recursion and a segmentation fault in the underlying GEOS
| library. Spatial field lookups and the
| `django.contrib.gis.forms.GeometryField` form field are also
| affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x,
| and 4.2.x) were not evaluated and may also be affected. Django would
| like to thank Andrew MacPherson and kimchunbok_ for reporting this
| issue.


CVE-2026-15920[3]:
| An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before
| 6.0.8. `django.contrib.admin.utils.display_for_field()` renders
| `URLField` values as clickable links in the admin without validating
| the URL. A value stored with an unsafe scheme is displayed as a link
| on changelist and read-only admin pages, which allows cross-site
| scripting against staff users who click the link.  Exploitation
| requires the unsafe value to already be stored in the database.
| `URLField` validation through a `ModelForm` or the admin rejects
| unsafe schemes, so this affects applications that persist `URLField`
| data without running model validation, for example through direct
| queryset writes, deserialization, or bulk import of untrusted input.
| Django would like to thank Egor Saltykov for reporting this issue.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-15307
https://www.cve.org/CVERecord?id=CVE-2026-15307
[1] https://security-tracker.debian.org/tracker/CVE-2026-15337
https://www.cve.org/CVERecord?id=CVE-2026-15337
[2] https://security-tracker.debian.org/tracker/CVE-2026-15830
https://www.cve.org/CVERecord?id=CVE-2026-15830
[3] https://security-tracker.debian.org/tracker/CVE-2026-15920
https://www.cve.org/CVERecord?id=CVE-2026-15920

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
python-django, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1143611@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Chris Lamb <lamby@debian.org> (supplier of updated python-django package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 04 Aug 2026 15:57:59 -0700
Source: python-django
Built-For-Profiles: nocheck
Architecture: source
Version: 3:5.2.17-1
Distribution: unstable
Urgency: high
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Chris Lamb <lamby@debian.org>
Closes: 1143611
Changes:
 python-django (3:5.2.17-1) unstable; urgency=high
 .
   * New upstream security release:
 .
     - CVE-2026-15307: Prevent a server-side file-write and request forgery via
       geoospatial lookups. Spatial lookups allowed str and dict lookup values
       to be passed to the GDALRaster class when they represented rasters.
       Depending on the raster driver, this could write a file to disk (in some
       cases enabling remote code execution) or issue a network request as the
       Django process user. Because the Django admin changelist permits
       filtering via ModelAdmin.lookup_allowed(), the flaw was reachable by
       staff users with view permissions on any registered model containing a
       spatial field.
 .
       Dictionaries and strings that are not valid GEOSGeometry instances, e.g.
       a serialized dictionary are now disallowed by spatial lookups. (This is a
       backward incompatible change.)
 .
     - CVE-2026-15337: Avoid a potential denial-of-service vulnerability in the
       check_for_language() method in the django.utils.translation method. This
       was subject to a potential denial-of-service (DoS) attack when checking
       many distinct, very long language codes. Each code was used as a key in
       an in-memory cache, consuming process memory.
 .
       The language value reaches this function through the set_language() view
       of django.views.i18n (which is not active by default) from POST data.
       Since request data is limited by the DATA_UPLOAD_MAX_MEMORY_SIZE setting
       and the cache is configured to store a maximum number of entries, the
       memory that could be consumed was bounded. To mitigate this
       vulnerability, language codes longer than 500 characters are now rejected
       before the cached lookup.
 .
     - CVE-2026-15830: Prevent a potential denial-of-service vulnerability via
       nested geometry collections. GEOSGeometry was subject to a potential
       denial-of-service attack when provided deeply nested GEOMETRYCOLLECTION
       objects leading to a segmentation fault in GEOS. A maximum depth of 198
       GEOMETRYCOLLECTIONs is now enforced for the well-known text (WKT) format
       and a maximum number of 198 GEOMETRYCOLLECTIONs in total (breadth and
       depth) is enforced for well-known binaries (WKB). Lookups against spatial
       fields and the GeometryField form field were also affected.
 .
     - CVE-2026-15920: Prevnt a potential cross-site scripting (XSS) attack via
       URLField values in the Django admin. The admin renders URLField values as
       clickable links on changelist views and read-only fields. The link was
       generated without validating the value as a safe URL, so a stored value
       using a potentially dangerous scheme was rendered as a link. URLField
       values shown via display_for_field are now validated using URLValidator
       before a link is rendered and displayed as plain text if validation is
       failed.
 .
     (Closes: #1143611)
 .
     <https://www.djangoproject.com/weblog/2026/aug/04/security-releases/>
 .
   * Bump debhelper compatibility level to 13.
Checksums-Sha1:
 83c09400adc8bb93238b4622da945e177e062332 2790 python-django_5.2.17-1.dsc
 7c0ecfdec9fdd9c3dcc1e96be06dbd6841beee3b 10889740 python-django_5.2.17.orig.tar.gz
 bd6e733573eac179e34f0d3f09b12f7304854e7e 39640 python-django_5.2.17-1.debian.tar.xz
 4d32107b31a6ffe5d32c6305764fe4183547ed65 8227 python-django_5.2.17-1_amd64.buildinfo
Checksums-Sha256:
 dacc146732b44f03d75b62bb4284c4b1fab0b8e6d2d6ccc70c6c0347df465212 2790 python-django_5.2.17-1.dsc
 9d4d93be539a18ab80d058eb515900e10951e04c537c5a6b394fc49528d3251f 10889740 python-django_5.2.17.orig.tar.gz
 31019458a8800ce2876b82a7e5a087ac6454ca4cee618586ea370627dcddf860 39640 python-django_5.2.17-1.debian.tar.xz
 3bd37d3f3735b3c7b137c876cb94ec6d76319b9a005843b824bd269b005f2ecb 8227 python-django_5.2.17-1_amd64.buildinfo
Files:
 dd0ea56833bf913480f806ba78db832f 2790 python optional python-django_5.2.17-1.dsc
 d3e9f9ca5c6d7d044a97675def960297 10889740 python optional python-django_5.2.17.orig.tar.gz
 0f11b054f81f0d93bd2b6d98d1ba3ae0 39640 python optional python-django_5.2.17-1.debian.tar.xz
 b3ad2ae6cbd28cd57bc8d1fe22da78aa 8227 python optional python-django_5.2.17-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmpydeYACgkQHpU+J9Qx
HlgghRAAlnkZmVxlgboDQgFlPGkT4QFkeLNJUMZndlgabuNiUJFEOad6kx9zjcDy
efkkZ/X7FPQEzywblK+YOxPnppn5tETRaroDYwF5+a+ti/2s5ChHQIWTU8iM/Q6Z
LQsIVUjvf5xG+ykyOx2r1usm0xvfG2kDCtqM738e9qED2LQi/TgIv8PTLhc/Bb0A
vXY2MKfJNGMNPbZNjV4Igdpimmc5iGTVdQ/5nzBgmRm4LtlfEsy0tU/PKiYs4CcK
7Ni2MTq9DNBiZGbvr18JCNh2xjY6wR6xiGouR0MKEPqY9yDJ/lI47XjkwKVYQz+o
eYWSu4R1ozNLR5zKiO/sAMXuGorhZzxuVLrHID6NZ425IUPI52K18GpIDbpDfGDk
Pdmc4L9PijBNEmbjRETdKhbB3vtDIZgo4oT/4hxXbu2+sM42g+YCKQSnanI5Of8a
rR+zIWsyNcLhbIccvlhWtutfZXsvdLrLfvYPtSpYucU8fPwIZvNKnYNkT4HbIqov
cSYXX05R4uIi6Mxrszv3+J+uAtEk7OU/HYcQCcR2YojyajW7+/kQcGGx1WHc4qow
A5WeGEdlNYWz42aQrCeqyqHiEAqPFldr57ncFN4ctRa6m89p3XZMbKx5tw5mdzm4
LrMyNZtjGCc0l68qCidahDx7Jyspm9JGFeUb9bK30pi0QPjM5X0=
=bbVZ
-----END PGP SIGNATURE-----