Is CVE-2026-111362 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111362 being exploited in the wild.

How severe is CVE-2026-111362?

Medium severity, with a CVSS score of 5.3, published 3 November 2026.

Which products and versions are affected?

Django Software Foundation Django 6.1 before 6.1.3, 6.0 before 6.0.10, 5.2 before 5.2.19.

Is there a fix for CVE-2026-111362?

Yes: fixed in Django 6.1.3, 6.0.10, 5.2.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111362 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111362?

Check whether you run Django Software Foundation Django at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111362: Django SSRF in GeoJSON coordinate reference systems

CVE-2026-111362 · Severity: medium · CVSS 5.3 · Published 2026-11-03

Django's geographic information module does not properly validate external coordinate reference system definitions when processing GeoJSON data. This allows attackers to craft malicious GeoJSON input that triggers the server to make requests to arbitrary destinations, potentially leading to data exposure or internal network reconnaissance.

Technologies: Django Software Foundation Django. Vendors: Django Software Foundation.

Quick answers

Is CVE-2026-111362 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111362 being exploited in the wild.
How severe is CVE-2026-111362?: Medium severity, with a CVSS score of 5.3, published 3 November 2026.
Which products and versions are affected?: Django Software Foundation Django 6.1 before 6.1.3, 6.0 before 6.0.10, 5.2 before 5.2.19.
Is there a fix for CVE-2026-111362?: Yes: fixed in Django 6.1.3, 6.0.10, 5.2.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111362 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111362?: Check whether you run Django Software Foundation Django at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Django 6.1.3, 6.0.10, 5.2.19

Technical details

The OGRGeometry class in django.contrib.gis.gdal does not restrict external coordinate reference system (CRS) definitions in GeoJSON input, allowing server-side request forgery (SSRF) attacks. An attacker can craft a GeoJSON document with a malicious crs member that causes the server to make HTTP requests to attacker-controlled or internal destinations. This is a network-based attack requiring no authentication or user interaction beyond sending a crafted request.

Affected products

Django Software Foundation Django 6.1 before 6.1.3, 6.0 before 6.0.10, 5.2 before 5.2.19

Timeline

2026-11-03: disclosed: CVE-2026-111362 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.