This vulnerability in Django's GeoDjango module arises from uncontrolled recursion triggered by deeply nested GEOMETRYCOLLECTION objects supplied as WKT, WKB, or hex-encoded WKB. The recursion causes a segmentation fault in the underlying GEOS library, resulting in a denial-of-service condition. The issue affects spatial field lookups and the GeometryField form field. It impacts Django versions 5.2 prior to 5.2.17 and 6.0 prior to 6.0.8. Earlier unsupported versions such as 5.1.x, 5.0.x, and 4.2.x were not evaluated but may also be vulnerable. The vulnerability is tracked as CWE-674 (Uncontrolled Recursion).

The vulnerability allows an attacker to cause a denial-of-service by triggering a segmentation fault through crafted deeply nested geometry collections. There is no impact on confidentiality or integrity reported. The attack vector is network-based with no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or remediation level has been published at this time. Users should monitor Django project advisories for updates and consider mitigating exposure to untrusted spatial data inputs until a fix is available.