Django 6.1.3, 6.0.10 and 5.2.19 fix six issues, including two GDAL SSRF paths in GeoDjango
Victoria Shinder2 min readThe Django team has issued security releases 6.1.3, 6.0.10 and 5.2.19, with patches on the main, 6.1, 6.0 and 5.2 branches. They fix six issues. The one rated moderate, CVE-2026-111362, is a server-side request forgery in GeoDjango: GeoJSON geometries could name a coordinate reference system by URL, GDAL still resolves such URLs, and any path that built a geometry from user input could make a network request or read a file as the Django process user. Spatial lookups, the GeometryField form field and GEOSGeometry now reject such references; the DataSource and LayerMapping utilities for trusted data still accept them.
A second SSRF path, CVE-2026-114582, ran through SpatialReference string input, which GDAL also resolved as URLs or files. Django now disables network and file access when parsing such strings on GDAL 3.9 and later and rejects DICT: references on all versions. Full protection requires GDAL 3.9, and a new system check, gis.W001, warns when an older GDAL is installed.
The other four are rated low. UpdateCacheMiddleware and cache_page() produced the same cache key for a request that omitted a header listed in Vary and one that sent it empty, so a cached response could be served to the wrong user (CVE-2026-113593); keys now distinguish the two, as RFC 9111 requires. Base64-encoded multipart uploads could be buffered entirely in memory regardless of FILE_UPLOAD_MAX_MEMORY_SIZE (CVE-2026-108147). GIS form widgets wrote invalid values unescaped into logs (CVE-2026-111211). And admin users with only view permission could see a full password hash for some custom user models (CVE-2026-113733).
The team encourages all users to upgrade as soon as possible.
What it means
The cache fix changes behaviour on deploy: responses cached under the old keys for requests without a Vary header will no longer match and will be cached again. GeoDjango sites should check their GDAL version, because on anything older than 3.9 the SpatialReference fix is only partial.