Django 6.0.8

Release Date: August 4, 2026

Django 6.0.8 — Released August 4, 2026. This release resolves four security issues — one rated high, two rated moderate, one rated low — and fixes several bugs introduced in Django 6.0.7. All users of Django 6.0 are strongly encouraged to upgrade immediately.

Security Fixes

CVE-2026-15307 — Server-Side File-Write and Request Forgery via Spatial Lookups (High)

Spatial lookups previously allowed str and dict lookup values to reach GDALRaster when they represented rasters. Depending on the raster driver, this could write a file to disk — in some cases enabling remote code execution — or issue a network request as the Django process user. The flaw was reachable by staff users with view permission on any registered model containing a spatial field, via lookup_allowed() filtering on the admin changelist.

Spatial lookups now disallow dict values and any str that is not a valid GEOSGeometry. This is a backward incompatible change; assignments to model fields are unaffected.

CVE-2026-15830 — Denial of Service via Nested Geometry Collections (Moderate)

Deeply nested GEOMETRYCOLLECTION objects could trigger a segmentation fault in GEOS. A maximum depth of 198 collections is now enforced for WKT input, and a maximum of 198 collections total (breadth and depth) for WKB. The limit is configurable via the new max_geom_collections argument on GEOSGeometry, the form field, and the model field. GeoJSON inputs are unaffected.

CVE-2026-15920 — Cross-Site Scripting via URLField Values in the Admin (Moderate)

The admin rendered URLField values as clickable links without validating the scheme. Values are now validated with URLValidator before a link is rendered; invalid values display as plain text.

CVE-2026-15337 — Denial of Service in check_for_language() (Low)

Many distinct, very long language codes could exhaust in-memory cache memory. Language codes longer than 500 characters are now rejected before the cached lookup.

Bugfixes

Fixed a regression in Django 6.0 causing bulk_create() to crash on databases that return rows from bulk inserts when a related object providing the primary key was saved after assignment (#37234).
Added compatibility with sqlparse 0.5.5 (#37235).

Upgrade Notes

Review the spatial-lookup restrictions in CVE-2026-15307 before deploying, as they affect existing code paths. For teams using GeoDjango, the max_geom_collections parameter provides control over the new nesting limits. See the Django 6.0.8 release notes and the raster security considerations documentation for full migration guidance.