---
id: "CVE-2026-111362"
kind: "vulnerability"
aliases: ["CVE-2026-111362"]
title: "Django: GeoJSON input can trigger server-side requests to attacker-chosen destinations"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["django", "gis", "python", "runtime", "web-backend"]
not_affected_if: ["no-gis-contrib", "no-untrusted-geojson"]
published_at: "2026-11-03T16:17:18+00:00"
first_seen_at: "2026-11-03T16:21:42+00:00"
updated_at: "2026-11-03T16:24:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111362", "first_seen_at": "2026-11-03T16:21:42+00:00"}]
---

# Django: GeoJSON input can trigger server-side requests to attacker-chosen destinations

Django's GIS OGRGeometry class accepts external coordinate reference system definitions in GeoJSON input without restriction. A remote attacker can send crafted crs members to make the server issue requests to destinations of their choosing (server-side request forgery).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Django version with `python -m django --version`, and look for `django.contrib.gis` in INSTALLED_APPS
- Check whether the application passes untrusted GeoJSON into `OGRGeometry`
- Compare the version against the fixed releases listed in the fix section

## Fix

- Django 6.1: upgrade to `6.1.3` or later
- Django 6.0: upgrade to `6.0.10` or later
- Django 5.2: upgrade to `5.2.19` or later
- Earlier unsupported series (5.1.x, 5.0.x, 4.2.x) were not evaluated by the sources and may also be affected

## Timeline

- 2026-11-03T16:21:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111362

## Documents

- [fix] Patch: github.com https://github.com/django/django/commit/31bef742da017bc71fdce9298c30984aad844102
- [fix] Patch: github.com https://github.com/django/django/commit/649fb7985f67d5936dfb8caae6a54c0870dc8eec
- [fix] Patch: github.com https://github.com/django/django/commit/e938f676fcca72f41247b0e96d4f0805e1722913
- [fix] Patch: github.com https://github.com/django/django/commit/ecb2b77b49890d6b2120f73fb3d7eb7ac7650143

## From the sources

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
`django.contrib.gis.gdal.OGRGeometry` does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause server-side requests to attacker-selected destinations via crafted crs members.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Submersion Security Research Team for reporting this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_