CVE-2026-53877: Heap buffer over-read in GDALRaster
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. django.contrib.gis.gdal.GDALRaster over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the vsibuffer property is accessed. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53877?
The severity of CVE-2026-53877 is rated as medium with a score of 4.8.
How do I fix CVE-2026-53877?
To fix CVE-2026-53877, update Django to version 6.0.7 or 5.2.16 or later.
What is the impact of CVE-2026-53877?
CVE-2026-53877 can lead to the disclosure of adjacent memory or service degradation through potential segmentation faults.
Which versions of Django are affected by CVE-2026-53877?
CVE-2026-53877 affects Django versions 6.0 prior to 6.0.7 and 5.2 prior to 5.2.16.
What kind of vulnerability is CVE-2026-53877?
CVE-2026-53877 is a heap buffer over-read vulnerability in the GDALRaster component of Django.