What’s Vulnerable › Vulnerabilities

CVE-2026-53877: Heap buffer over-read in GDALRaster

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-07 · updated 2026-10-25
• Weakness: CWE-805

Description

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.

Affected products

• Django: from 5.2 before 5.2.16; from 6.0 before 6.0.7 — fixed in 5.2.16, 6.0.7
• Pypi Django: before 5.2.16; from 6.0.0 before 6.0.7; 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.1, 1.1.1 (+424) — fixed in 5.2.16, 6.0.7

How to fix

Upgrade to a fixed version: Django 5.2.16, 6.0.7; Pypi Django 5.2.16, 6.0.7. Check the vendor advisory for mitigations.

References

• https://docs.djangoproject.com/en/dev/releases/security/
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases/

Get alerted when CVE-2026-53877 or the next vulnerability affects your stack