The vulnerability arises when deeply nested GEOMETRYCOLLECTION objects are parsed as well‑known text, well‑known binary, or hex‑encoded binary, causing the GEOS geometry library to recurse without bound and ultimately trigger a segmentation fault. This results in an application crash that can be used to deny service to users. The weakness is classified as unbounded recursion (CWE‑674) and missing input validation (CWE‑606).

The affected product is Django, specifically the GeoDjango component. Versions prior to 5.2.17 in the 5.2 series and prior to 6.0.8 in the 6.0 series are impacted. Earlier Django releases such as 5.1.x, 5.0.x, and 4.2.x have not been evaluated but are suspected to be vulnerable as well.

The CVSS score of 6.9 indicates moderate severity. While the EPSS score is not available, the fact that exploitation requires delivering a specially crafted geometry object suggests that the vulnerability can be triggered in any environment that accepts untrusted geometry input. The attack vector is likely remote via public API or web forms that process geometry data, leading to a denial‑of‑service condition through application crash. The vulnerability is not listed in CISA’s KEV catalog, but the impact of a service crash for any critical application should not be underestimated.