CVE-2026-15830 is a medium severity denial-of-service vulnerability in Django's GeoDjango module. It occurs due to uncontrolled recursion when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB. This triggers a segmentation fault in the underlying GEOS library, affecting spatial field lookups and the django.contrib.gis.forms.GeometryField form field. The issue impacts Django versions 5.2 prior to 5.2.17 and 6.0 prior to 6.0.8. Earlier unsupported versions such as 5.1.x, 5.0.x, and 4.2.x may also be vulnerable but have not been evaluated. No official remediation level or patch links are provided in the data.

The vulnerability can cause a denial-of-service condition by crashing the application through a segmentation fault in the GEOS library when processing maliciously crafted deeply nested geometry collections. There is no impact on confidentiality or integrity reported, only availability is affected. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The affected versions are 5.2 before 5.2.17 and 6.0 before 6.0.8. Users should monitor official Django project advisories for patches or updates addressing this issue. Until a fix is applied, avoid processing untrusted deeply nested GEOMETRYCOLLECTION inputs in GeoDjango components.