Package
openstack-horizon-2025.2
Component
django
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
CVE-2026-15307 is in GeoDjango (django.contrib.gis): spatial lookups pass the right-hand-side value to the GDALRaster constructor. Only applications that enable django.contrib.gis and query a GeometryField or RasterField can reach it. Horizon does not use GeoDjango: neither horizon itself (stable branch at the packaged commit) nor any of the 14 bundled Kolla plugin dashboards references django.contrib.gis or defines spatial fields. django.contrib.gis is not in INSTALLED_APPS (no plugin adds it either), the Django admin is not enabled, and the package ships no GDAL/GEOS libraries. The vulnerable code is present in the Django wheel but never executed. Upstream ships no fixed Django 4.2.x release (fixes are in 5.2.17/6.0.8), and Horizon stable/2025.1 and stable/2025.2 require Django>=4.2,<4.3.
Status