What is the CVSS score of CVE-2025-64460?

CVE-2025-64460 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2025-64460?

A denial-of-service vulnerability in Django's XML deserializer could allow attackers to crash applications and exhaust server resources through maliciously crafted XML input.. A patch is available.

How to fix or mitigate CVE-2025-64460?

Within 24 hours: Identify all systems running Django 5.2 before 5.2.9, 5.1 before 5.1.15, or 4.2 before 4.2.27, and assess exposure to XML deserialization endpoints. Within 7 days: Apply vendor patches to all affected systems or implement compensating controls if patching is delayed. Within 30 days: Verify patch deployment across all environments and validate that XML deserialization functions normally post-update.

Python CVE-2025-64460

EUVD-2025-200248 HIGH

Inefficient Algorithmic Complexity (CWE-407)

2025-12-02 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92

GHSA-vrcr-9hj9-jcg6

Information Disclosure Python Ubuntu Debian Django Red Hat Suse

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ubuntu

MEDIUM

qualitative

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 14:04 euvd

EUVD-2025-200248

Analysis Generated

Mar 15, 2026 - 14:04 vuln.today

Patch released

Mar 15, 2026 - 14:04 nvd

Patch available

CVE Published

Dec 02, 2025 - 16:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on django (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 5.2a1.

DescriptionCVE.org

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in django.core.serializers.xml_serializer.getInnerText() allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML Deserializer. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

Analysis

Technical ContextAI

Insecure deserialization occurs when untrusted data is used to reconstruct objects, allowing attackers to manipulate serialized data to execute arbitrary code.

RemediationAI

A vendor patch is available — apply it immediately. Avoid deserializing untrusted data. Use safe serialization formats (JSON instead of native serialization). Implement integrity checks on serialized data.

More in Python

View all

CVE-2025-24016 CRITICAL Act Now POC

9.9 Feb 10

Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t

CVE-2025-27520 CRITICAL Act Now POC

9.8 Apr 04

BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser

CVE-2025-2945 CRITICAL Act Now POC

9.9 Apr 03

pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi

CVE-2013-5093 MEDIUM This Month POC

6.8 Sep 27

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python

CVE-2025-32375 CRITICAL Act Now POC

9.8 Apr 09

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2024-21644 HIGH Act Now POC

7.5 Jan 08

pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.

CVE-2017-9462 HIGH Act Now POC

8.8 Jun 06

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse

CVE-2026-39987 CRITICAL Act Now POC

9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/

CVE-2024-21645 MEDIUM This Month POC

5.3 Jan 08

pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne

CVE-2026-33017 CRITICAL Act Now POC

9.3 Mar 17

Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301

CVE-2026-55255 HIGH Act Now POC

8.4 Jun 19

Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing

Same weakness CWE-407 – Inefficient Algorithmic Complexity

View all

CVE-2026-59094 HIGH POC

8.7

CVE-2024-9631 HIGH POC

7.5

CVE-2026-27903 HIGH POC

7.5

CVE-2026-3988 HIGH POC

7.5

CVE-2026-45186 HIGH POC

7.5

CVE-2024-8233 HIGH POC

7.5

CVE-2022-45061 HIGH POC

7.5

CVE-2019-19331 HIGH POC

7.5

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

Vendor StatusVendor

Ubuntu

Priority: Medium

python-django

Release	Status	Version
upstream	needs-triage	-
bionic	released	1:1.11.11-1ubuntu1.21+esm13
focal	released	2:2.2.12-1ubuntu0.29+esm6
jammy	released	2:3.2.12-2ubuntu1.24
noble	released	3:4.2.11-1ubuntu1.13
plucky	released	3:4.2.18-1ubuntu1.7
questing	released	3:5.2.4-1ubuntu2.2
trusty	released	1.6.11-0ubuntu1.3+esm9
xenial	released	1.8.7-1ubuntu5.15+esm10

USN-7903-1

Debian

Bug #1121788

python-django

Release	Status	Fixed Version	Urgency
bullseye	fixed	2:2.2.28-1~deb11u10	-
bullseye (security)	fixed	2:2.2.28-1~deb11u12	-
bookworm	fixed	3:3.2.25-0+deb12u1	-
bookworm (security)	fixed	3:3.2.25-0+deb12u2	-
trixie (security), trixie	fixed	3:4.2.28-0+deb13u1	-
forky, sid	fixed	3:4.2.29-1	-
trixie	fixed	3:4.2.27-0+deb13u1	-
(unstable)	fixed	3:4.2.27-1	-

DLA-4425-1 DSA-6117-1 DSA-6136-1

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Package Hub 15 SP6	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Leap 16.0	Fixed

CVE-2025-64460 vulnerability details – vuln.today

Back

openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
SUSE Package Hub 15 SP6	Fixed

Python CVE-2025-64460

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Python

Same weakness CWE-407 – Inefficient Algorithmic Complexity

Same technique Information Disclosure

Vendor StatusVendor

Ubuntu

Debian

SUSE

Share

External POC / Exploit Code