Django 5.2 & 6.0: GDALRaster Buffer Over-read (<=5.2.16, <=6.0.7)
CVE-2026-53877 Published on July 7, 2026
Heap buffer over-read in GDALRaster
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
`django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy for reporting this issue.
Timeline
Initial report received.
Vulnerability confirmed. 9 days later.
Security release issued. 26 days later.
Weakness Type
Buffer Access with Incorrect Length Value
The software uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer. When the length value exceeds the size of the destination, a buffer overflow could occur.
Products Associated with CVE-2026-53877
Want to know whenever a new CVE is published for Django Project Django? stack.watch will email you.
Affected Versions
djangoproject Django:- Version 6.0 and below 6.0.7 is affected.
- Version 6.0.7 is unaffected.
- Version 5.2 and below 5.2.16 is affected.
- Version 5.2.16 is unaffected.