<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/django-security-releases-issued-6-0-8-and-5-2-17-kc7v4fqds" -->

---
title: Django security releases issued: 6.0.8 and 5.2.17
description: Django has issued security releases 6.0.8 and 5.2.17 addressing four CVEs. CVE-2026-15307 (high severity) allows server-side file writes or request forgery via...
canonical: https://daily.dev/posts/django-security-releases-issued-6-0-8-and-5-2-17-kc7v4fqds
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: Django security releases issued: 6.0.8 and 5.2.17 | daily.dev
og:description: Django has issued security releases 6.0.8 and 5.2.17 addressing four CVEs. CVE-2026-15307 (high severity) allows server-side file writes or request forgery via...
og:url: https://daily.dev/posts/django-security-releases-issued-6-0-8-and-5-2-17-kc7v4fqds
og:image: https://api.daily.dev/og/posts/KC7V4FqDS.png
og:image:alt: Django security releases issued: 6.0.8 and 5.2.17
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Django security releases issued: 6.0.8 and 5.2.17

**[Django](https://daily.dev/sources/django)** · 4 min read · 9 upvotes · 1 comments

## Summary

Django has issued security releases 6.0.8 and 5.2.17 addressing four CVEs. CVE-2026-15307 (high severity) allows server-side file writes or request forgery via spatial lookups accepting unsafe str/dict values, potentially enabling remote code execution. CVE-2026-15337 (low severity) is a denial-of-service in check_for_language() via very long language codes, now rejected above 500 characters. CVE-2026-15830 (moderate severity) is a DoS via deeply nested GEOMETRYCOLLECTION objects causing a segfault in GEOS, now limited to 198 collections. CVE-2026-15920 (moderate severity) is a stored XSS via URLField values rendered as links in the admin without URL validation. All users are urged to upgrade immediately.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.djangoproject.com/weblog/2026/aug/04/security-releases>

## Questions this post answers

### What does Django CVE-2026-15307 affect and how does it get fixed in 6.0.8?

CVE-2026-15307 is a high-severity flaw where spatial lookups accepted str and dict values passed to GDALRaster, which could write files to disk (enabling remote code execution in some cases) or issue network requests as the Django process user. It was reachable by staff users via admin changelist filtering. Django 6.0.8 and 5.2.17 now disallow dict values and invalid GEOSGeometry strings in spatial lookups, a backward-incompatible change.

_Teams running GeoDjango track upgrade-breaking security fixes like this one on daily.dev._

### Is upgrading to Django 6.0.8 backward compatible for spatial lookups?

No, the fix for CVE-2026-15307 is explicitly backward incompatible. Spatial lookups no longer accept dict values or str values that aren't valid GEOSGeometry, such as a serialized dictionary. Model field assignments are unaffected and still accept these types; only lookups are restricted. Guidance on validating untrusted input for spatial lookups is provided in the raster security considerations documentation.

_Developers weighing breaking changes before an upgrade often follow release notes like this via daily.dev._

### What causes the denial-of-service vulnerability in Django's GEOSGeometry with nested geometry collections?

CVE-2026-15830 is a moderate-severity denial-of-service issue where deeply nested GEOMETRYCOLLECTION objects cause a segmentation fault in GEOS. Django 6.0.8 and 5.2.17 now enforce a maximum depth of 198 GEOMETRYCOLLECTIONs for WKT and a maximum total of 198 for WKB, customizable via the new max_geom_collections argument on GEOSGeometry, form fields, and model fields. The limit doesn't apply to GeoJSON since GDAL parses those inputs differently.

_Developers hardening GIS-heavy Django apps against crafted inputs keep tabs on fixes like this through daily.dev._

## Community discussion

Top comments from developers on daily.dev.

**@mirkan** · 0 upvotes

> good guy django

## Similar posts on daily.dev

- [Issue 340: Django security releases 6.0.6 and 5.2.15](https://daily.dev/posts/issue-340-django-security-releases-6-0-6-and-5-2-15-0r7w6h8w1) · Django News · 0 upvotes · 0 comments
- [Django Security Fixes, Python Releases, and New Tools](https://daily.dev/posts/django-security-fixes-python-releases-and-new-tools-xiycsmntw) · Django News · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#django](https://daily.dev/tags/django)

[View this post on daily.dev](https://daily.dev/posts/django-security-releases-issued-6-0-8-and-5-2-17-kc7v4fqds)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"Django security releases issued: 6.0.8 and 5.2.17","url":"https://daily.dev/posts/django-security-releases-issued-6-0-8-and-5-2-17-kc7v4fqds","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/django-security-releases-issued-6-0-8-and-5-2-17-kc7v4fqds"},"datePublished":"2026-08-04T15:25:22.383Z","dateModified":"2026-09-14T08:22:40.745Z","description":"Django has issued security releases 6.0.8 and 5.2.17 addressing four CVEs. CVE-2026-15307 (high severity) allows server-side file writes or request forgery via...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/71538c3530bf6c6bbacb396cf5ffc721?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/71538c3530bf6c6bbacb396cf5ffc721?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Django","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Django","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/4a658d547a52423e99fe641ecc576195","url":"https://daily.dev/sources/django"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/django-security-releases-issued-6-0-8-and-5-2-17-kc7v4fqds","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":9},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,cyber,python,django","timeRequired":"PT4M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Django","item":"https://daily.dev/sources/django"},{"@type":"ListItem","position":3,"name":"Django security releases issued: 6.0.8 and 5.2.17"}]}
{"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/django-security-releases-issued-6-0-8-and-5-2-17-kc7v4fqds","comment":[{"@type":"Comment","text":"good guy django","datePublished":"2026-08-07T13:17:01.690Z","url":"https://daily.dev/posts/KC7V4FqDS#c-GzAop2Q4l","author":{"@type":"Person","name":"mirkan","url":"https://daily.dev/mirkan","image":"https://avatars.githubusercontent.com/u/32144322?v=4"}}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/django-security-releases-issued-6-0-8-and-5-2-17-kc7v4fqds#faq","mainEntity":[{"@type":"Question","name":"What does Django CVE-2026-15307 affect and how does it get fixed in 6.0.8?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-15307 is a high-severity flaw where spatial lookups accepted str and dict values passed to GDALRaster, which could write files to disk (enabling remote code execution in some cases) or issue network requests as the Django process user. It was reachable by staff users via admin changelist filtering. Django 6.0.8 and 5.2.17 now disallow dict values and invalid GEOSGeometry strings in spatial lookups, a backward-incompatible change. Teams running GeoDjango track upgrade-breaking security fixes like this one on daily.dev."}},{"@type":"Question","name":"Is upgrading to Django 6.0.8 backward compatible for spatial lookups?","acceptedAnswer":{"@type":"Answer","text":"No, the fix for CVE-2026-15307 is explicitly backward incompatible. Spatial lookups no longer accept dict values or str values that aren't valid GEOSGeometry, such as a serialized dictionary. Model field assignments are unaffected and still accept these types; only lookups are restricted. Guidance on validating untrusted input for spatial lookups is provided in the raster security considerations documentation. Developers weighing breaking changes before an upgrade often follow release notes like this via daily.dev."}},{"@type":"Question","name":"What causes the denial-of-service vulnerability in Django's GEOSGeometry with nested geometry collections?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-15830 is a moderate-severity denial-of-service issue where deeply nested GEOMETRYCOLLECTION objects cause a segmentation fault in GEOS. Django 6.0.8 and 5.2.17 now enforce a maximum depth of 198 GEOMETRYCOLLECTIONs for WKT and a maximum total of 198 for WKB, customizable via the new max_geom_collections argument on GEOSGeometry, form fields, and model fields. The limit doesn't apply to GeoJSON since GDAL parses those inputs differently. Developers hardening GIS-heavy Django apps against crafted inputs keep tabs on fixes like this through daily.dev."}}]}
```