CVE-2026-111362 Server-side request forgery via crs member of GeoJSON geometries

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.OGRGeometry does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause server-side requests to attacker-selected...

EUVD-2026-116020

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.OGRGeometry does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause server-side requests to attacker-selected...

CVE-2026-111362

A Server-Side Request Forgery (SSRF) vulnerability exists in Django versions 6.1 before 6.1.3 , 6.0 before 6.0.10 , and 5.2 before 5.2.19 . The root cause is that the django.contrib.gis.gdal.OGRGeometry component fails to restrict external coordinate reference system definitions within GeoJSON in...