# CVE-2026-111362: Django SSRF in GeoJSON coordinate reference systems

Source: https://junglewise.ai/threats/cve-2026-111362-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-111362 · Severity: medium · CVSS 5.3 · Published 2026-11-03

Django's geographic information module does not properly validate external coordinate reference system definitions when processing GeoJSON data. This allows attackers to craft malicious GeoJSON input that triggers the server to make requests to arbitrary destinations, potentially leading to data exposure or internal network reconnaissance.

Technologies: [Django Software Foundation Django](https://junglewise.ai/threats/technologies/django-software-foundation-django). Vendors: [Django Software Foundation](https://junglewise.ai/threats/vendors/django-software-foundation).

## Quick answers

**Is CVE-2026-111362 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111362 being exploited in the wild.

**How severe is CVE-2026-111362?** Medium severity, with a CVSS score of 5.3, published 3 November 2026.

**Which products and versions are affected?** Django Software Foundation Django 6.1 before 6.1.3, 6.0 before 6.0.10, 5.2 before 5.2.19.

**Is there a fix for CVE-2026-111362?** Yes: fixed in Django 6.1.3, 6.0.10, 5.2.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111362 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111362?** Check whether you run Django Software Foundation Django at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Django 6.1.3, 6.0.10, 5.2.19

## Technical details

The OGRGeometry class in django.contrib.gis.gdal does not restrict external coordinate reference system (CRS) definitions in GeoJSON input, allowing server-side request forgery (SSRF) attacks. An attacker can craft a GeoJSON document with a malicious crs member that causes the server to make HTTP requests to attacker-controlled or internal destinations. This is a network-based attack requiring no authentication or user interaction beyond sending a crafted request.

## Affected products

- Django Software Foundation Django 6.1 before 6.1.3, 6.0 before 6.0.10, 5.2 before 5.2.19

## Timeline

- 2026-11-03: disclosed: CVE-2026-111362 published

## References

- [https://pypi.org/project/Django/](https://pypi.org/project/Django/)
- [https://docs.djangoproject.com/en/dev/releases/security/](https://docs.djangoproject.com/en/dev/releases/security/)

## Related threats

- [Django GIS spatial reference string injection](https://junglewise.ai/threats/cve-2026-114582-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6)
- [Django log injection in BaseGeometryWidget.deserialize()](https://junglewise.ai/threats/cve-2026-111211-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6)
- [Django multipart parser excessive memory consumption via base64 Content-Transfer-Encoding](https://junglewise.ai/threats/cve-2026-108147-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-4-before)
- [Django authorization bypass in BaseModelFormSet deletion](https://junglewise.ai/threats/cve-2026-87975-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0)
- [Django spatial lookups SSRF via crafted VRT document](https://junglewise.ai/threats/cve-2026-87890-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0)