CVE-2026-53877
published 2026-07-07CVE-2026-53877: An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed…
PriorityP425medium4.8CVSS 3.1
AVNACHPRNUINSUCLINAL
EPSS
0.29%
21.1th percentile
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
`django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy for reporting this issue.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-27 | aap-cloud-billing-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-27 | metrics-service-rhel9 | — | — |
| ansible-automation-platform-tech-preview | metrics-service-rhel9 | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| discovery | discovery-server-rhel9 | — | — |
| djangoproject | django | >= 5.2 < 5.2.16 | 5.2.16 |
| djangoproject | django | >= 6.0 < 6.0.7 | 6.0.7 |
| satellite | iop-advisor-backend-rhel9 | — | — |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
djangoproject Django up to 5.2.15/6.0.6 GDALRaster contrib/gis/gdal memory corruption (Nessus ID 326318)
vuldb·2026-07-11·CVSS 4.8
CVE-2026-53877 [MEDIUM] djangoproject Django up to 5.2.15/6.0.6 GDALRaster contrib/gis/gdal memory corruption (Nessus ID 326318)
A vulnerability classified as critical was found in djangoproject Django up to 5.2.15/6.0.6. This affects an unknown part of the file contrib/gis/gdal of the component GDALRaster. Executing a manipulation can lead to memory corruption.
This vulnerability is tracked as CVE-2026-53877. The attack can be launched remotely. No exploit exists.
GHSA
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
ghsa_unreviewed·2026-07-07
CVE-2026-53877 [MEDIUM] CWE-805 An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
`django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy for reporting this issue.
Red Hat
django: Django: Information disclosure via heap buffer over-read in GDALRaster
vendor_redhat·2026-07-07·CVSS 4.8
CVE-2026-53877 [MEDIUM] CWE-126 django: Django: Information disclosure via heap buffer over-read in GDALRaster
django: Django: Information disclosure via heap buffer over-read in GDALRaster
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
`django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy for reporting this issue.
A flaw was found in Django. Instantiating django.contrib.gis.gdal.GDALRaster with a bytes object representing a raster file can trigger a heap buffer over-read in the vsi_buffer property, reading roughly 32 bytes past
No detection rules found.
No public exploits indexed.
2026-07-07
Published