Bug 2544149 (CVE-2026-87890)

Summary:	CVE-2026-87890 django: Server-side request forgery via unvalidated bytes in spatial lookups
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Django. When handling spatial lookups in its Geographic Information System (GIS) framework, raster data supplied as raw bytes is processed without proper encapsulation. If an application passes untrusted input into these lookups, an attacker can supply crafted data referencing external resources to induce the server into making unintended outbound network requests (Server-Side Request Forgery, or SSRF). This issue can allow an attacker to interact with internal services or access restricted resources reachable from the application host.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2547364, 2547363, 2547365
Bug Blocks:

Description OSIDB Bzimport 2026-09-30 17:22:10 UTC

A flaw was found in Django's GIS support. Spatial lookups accepted raster values supplied as raw bytes without requiring them to first be wrapped in django.contrib.gis.gdal.GDALRaster. Because such values are opened through GDAL's in-memory virtual filesystem, a crafted value could contain a VRT document referencing an external raster source, causing GDAL to issue outbound network requests as the Django process user while preparing the lookup. An application that passes attacker-controlled bytes directly into a spatial lookup could therefore be induced to make server-side requests to attacker-chosen hosts. This issue was overlooked in the fix for CVE-2026-15307. It is a backward-incompatible fix: raster values provided as bytes must now be explicitly wrapped in GDALRaster before use in spatial lookups, though byte values representing valid hexadecimal geometries remain accepted.