CVE-2026-53877
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed.
Risk Assessment
The risk includes potential disclosure of sensitive data from memory and application crashes (segfault), which can lead to service disruption and confidentiality breaches.
Recommendation
Immediately upgrade Django to version 6.0.7 or 5.2.16 (or later). Also check for unsupported series (e.g., 5.0.x, 4.1.x, 3.2.x) and consider upgrading them to a supported version.
Original NVD description (English source)
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.