id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
37491	GeometryField crashes with RecursionError on deeply nested GeoJSON	Philip Sørensen		"The `ExternalCRSBlocker.check()` added for CVE-2026-111362 (ecb2b77b49) parses GeoJSON input with `json.loads()` and doesn't catch `RecursionError`. When the input is nested more deeply than the recursion limit, e.g. a Point with 100,000 nested `[` in `coordinates`, `forms.GeometryField.clean()` raises `RecursionError` (HTTP 500) instead of a `ValidationError`. This also applies to the default widget and the admin. `BaseGeometryWidget.deserialize()` only catches `GEOSException`, `GDALException`, `ValueError` and `TypeError`.

On 6.1.2 the same input gives ""Invalid geometry value."", so this is a regression in 6.1.3, and presumably 6.0.10 and 5.2.19 too, since the fix was backported.

```python
from django.contrib.gis import forms
n = 100_000
forms.GeometryField().clean('{""type"": ""Point"", ""coordinates"": ' + ""["" * n + ""]"" * n + ""}"")
# 6.1.2: ValidationError; 6.1.3 / main: RecursionError
```

Patch: in `ExternalCRSBlocker.check()`, re-raise `RecursionError` from `json.loads()` as a `ValueError`, so that it's handled like the `JSONDecodeError` (a `ValueError` subclass) that callers already handle. Like #37418, the test mocks `json.loads()`, because the depth at which it raises depends on the interpreter's stack size."	Bug	assigned	GIS	dev	Release blocker			Philip Sørensen	Unreviewed	1	0	0	0	0	0