CVE-2026-114582

A flaw was found in Django. When handling spatial reference strings, input is passed directly to the underlying Geospatial Data Abstraction Library GDAL, which by default resolves network addresses and accesses files on the host system. A remote attacker can exploit this flaw by providing a craft...

Fedora 44 : gdal (2026-a002fccd0d)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a002fccd0d advisory. Backport fix for CVE-2026-49014. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Python Library Django 5.2.x < 5.2.19 / 6.0.x < 6.0.10 / 6.1.x < 6.1.3 Multiple Vulnerabilities

The detected version of the Django Python package is 5.2.x prior to 5.2.19, or 6.0.x prior to 6.0.10, or 6.1.x prior to 6.1.3. It is, therefore, affected by multiple vulnerabilities, including: - django.contrib.gis.gdal.OGRGeometry does not restrict external coordinate reference system definition...

SUSE CVE-2026-114582

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL's file and network access when parsing string input, which allows attackers to trigger...

CVE-2026-114582

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...

Linux Distros Unpatched Vulnerability : CVE-2026-114582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform...

CVE-2026-114582

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...

DEBIAN-CVE-2026-114582

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...

ALPINE-CVE-2026-114582

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...

UBUNTU-CVE-2026-114582

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...

CVE-2026-114582 Server-side request forgery via SpatialReference string input

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...

CVE-2026-114582 Server-side request forgery via SpatialReference string input

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...

CVE-2026-114582

The Django web framework (versions 6.1 before 6.1.3 , 6.0 before 6.0.10 , and 5.2 before 5.2.19 ) contains a vulnerability where the django.contrib.gis.gdal.SpatialReference component fails to restrict GDAL’s file and network access when parsing string input. This oversight allows an attacker to ...

EUVD-2026-116023

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...

CVE-2026-114582

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...

CVE-2026-114582 Server-side request forgery via SpatialReference string input

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...

PT-2026-136250

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.1.3 Django versions prior to 6.0.10 Django versions prior to 5.2.19 Description django.contrib.gis.gdal.SpatialReference and its associated transform methods and srs/srid setters fail to restrict GDAL file and networ...

Astra Linux – vulnerability in gdal

In GDAL versions 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. An attacker embeds the exploit as an oversized...

Server-side Request Forgery (SSRF)

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the spatial lookup handling in django/contrib/gis/db/models/fields.py and...

[SECURITY] Fedora 45 Update: gdal-3.13.3-2.fc45

Geospatial Data Abstraction Library GDAL/OGR is a cross platform C++ translator library for raster and vector geospatial data formats. As a library, it presents a single abstract data model to the calling application for all supported formats. It also comes with a variety of useful commandline...