CVE-2026-53877— Django 缓冲区错误漏洞

Heap buffer over-read in GDALRaster

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

使用不正确的长度值访问缓冲区

Django 缓冲区错误漏洞

djangoproject django是djangoproject基金会开源的一个Web应用开发框架。 Django 6.0.7之前版本和5.2.16之前版本存在缓冲区错误漏洞，该漏洞源于GDALRaster从字节对象构建时过度读取内存缓冲区，可能导致泄露相邻内存或通过访问vsi_buffer属性时出现分段错误造成服务降级。

N/A

N/A