Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-53877— Heap buffer over-read in GDALRaster

Quick assessment

Affected
djangoproject Django
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

djangoproject django是djangoproject基金会开源的一个Web应用开发框架。 Django 6.0.7之前版本和5.2.16之前版本存在缓冲区错误漏洞，该漏洞源于GDALRaster从字节对象构建时过度读取内存缓冲区，可能导致泄露相邻内存或通过访问vsi_buffer属性时出现分段错误造成服务降级。

CVSS 4.8 · Medium EPSS 0.44% · P36

Possible ATT&CK Techniques 1 AI

T1401

Affected Version Matrix 4

VendorProduct Version RangeStatus
djangoproject Django 6.0< 6.0.7 affected
6.0.7 unaffected
5.2< 5.2.16 affected
5.2.16 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53877

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Heap buffer over-read in GDALRaster
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用不正确的长度值访问缓冲区
Source: CVE Program / CVE List V5
Vulnerability Title
Django 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
djangoproject django是djangoproject基金会开源的一个Web应用开发框架。 Django 6.0.7之前版本和5.2.16之前版本存在缓冲区错误漏洞，该漏洞源于GDALRaster从字节对象构建时过度读取内存缓冲区，可能导致泄露相邻内存或通过访问vsi_buffer属性时出现分段错误造成服务降级。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
djangoproject Django 6.0 ~ 6.0.7 -

II. Public POCs for CVE-2026-53877

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53877

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-53877 (2)

Mailing List Discussions for CVE-2026-53877 (1)

Same Patch Batch · djangoproject · 2026-07-07 · 3 CVEs total

CVE-2026-53878 6.1 MEDIUM Header injection possibility since DomainNameValidator accepted newlines in input
CVE-2026-48588 4.2 MEDIUM Potential exposure of private data via cached Set-Cookie response

IV. Related Vulnerabilities

Same product: Django
Same vendor: djangoproject
Same weakness: CWE-805

V. Comments for CVE-2026-53877

No comments yet

Leave a comment