Skip to main content

Django CVE-2025-64460

| EUVDEUVD-2025-200248 HIGH
Inefficient Algorithmic Complexity (CWE-407)
2025-12-02 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 GHSA-vrcr-9hj9-jcg6
Python Information Disclosure Debian Ubuntu Red Hat Django Suse Djangoproject
7.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-407
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
Impact

Remote code execution, denial of service, or authentication bypass through manipulation of serialized object state. With a CVSS score of 7.5 (HIGH), this represents a significant risk.
Exploit ScenarioDerived

An attacker modifies a serialized object (e.g., in a cookie or API parameter) to include malicious payloads that execute during the deserialization process.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in django.core.serializers.xml_serializer.getInnerText() allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML Deserializer. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

RemediationAI

A vendor patch is available — apply it immediately. Avoid deserializing untrusted data. Use safe serialization formats (JSON instead of native serialization). Implement integrity checks on serialized data.

Affected VersionsENISA

Django 5.2 <5.2.9
Django 5.1 <5.1.15
Django 4.2 <4.2.27

Affected Packages

pypi django fix: 4.2.27, 5.1.15, 5.2.9

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Insecure deserialization occurs when untrusted data is used to reconstruct objects, allowing attackers to manipulate serialized data to execute arbitrary code.

Know when Django gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu MEDIUM
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Mar 15, 2026 - 14:04 nvd
Patch available
CVE Published
Dec 02, 2025 - 16:15 nvd
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 pypi packages depend on django (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 5.2a1.

Executive ViewAI

Why It Matters

A denial-of-service vulnerability in Django's XML deserializer could allow attackers to crash applications and exhaust server resources through maliciously crafted XML input. Organizations running affected Django versions should prioritize patching to prevent service disruptions and potential business continuity impacts.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement WAF rules to reject or rate-limit XML requests with excessive nesting or complexity; (2) Disable XML deserialization endpoints if not business-critical; (3) Implement request size limits and timeouts on XML processing; (4) Segment affected applications behind additional load balancers with per-request resource limits.

Threat Intelligence Overview

EPSS Score
0.1%
Top 81% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Django

View all
CVE-2021-23336 MEDIUM POC
5.9 Feb 15

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9
CVE-2017-12794 MEDIUM POC
6.1 Sep 07

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for
CVE-2022-34265 CRITICAL POC
9.8 Jul 04

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. Rated critical severity (CVSS 9.8), this vulne
CVE-2021-35042 CRITICAL POC
9.8 Jul 02

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input

CVE-2019-19844 CRITICAL POC
9.8 Dec 18

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. Rated critical severity (CVSS 9.8
CVE-2026-61594 CRITICAL POC
9.1 Sep 16

An authentication/authorization bypass in the djust Python live-view framework (versions prior to 1.0.7) lets unauthenti
CVE-2026-61599 HIGH POC
8.8 Sep 16

Unauthenticated arbitrary Python module import in djust before 1.0.7 lets any client that can reach the WebSocket or SSE
CVE-2020-9402 HIGH POC
8.8 Mar 05

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a

CVE-2016-6186 MEDIUM POC
6.1 Aug 05

Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/j
CVE-2026-93456 HIGH POC
8.4 Sep 18

Forged content modification in django-page-cms through 2.0.13 lets unauthenticated remote attackers exploit five CSRF-ex
CVE-2026-61593 HIGH POC
8.1 Sep 16

Cross-site request forgery in djust's Server-Sent-Events transport affects all versions prior to 1.0.7 and allows a cros
CVE-2026-61590 HIGH POC
7.4 Sep 16

Unauthenticated remote attackers can read live Django view and session state and invoke server-side handlers through dju

Same weakness CWE-407 – Inefficient Algorithmic Complexity

View all
CVE-2026-90776 HIGH POC
8.7
CVE-2026-59094 HIGH POC
8.7
CVE-2026-54284 HIGH POC
8.7
CVE-2022-45061 HIGH POC
7.5
CVE-2026-71321 HIGH POC
7.5
CVE-2026-59887 HIGH POC
7.5
CVE-2026-73643 HIGH POC
7.5
CVE-2026-59870 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

Ubuntu

Priority: Medium
python-django
Release Status Version
upstream needs-triage -
bionic released 1:1.11.11-1ubuntu1.21+esm13
focal released 2:2.2.12-1ubuntu0.29+esm6
jammy released 2:3.2.12-2ubuntu1.24
noble released 3:4.2.11-1ubuntu1.13
plucky released 3:4.2.18-1ubuntu1.7
questing released 3:5.2.4-1ubuntu2.2
trusty released 1.6.11-0ubuntu1.3+esm9
xenial released 1.8.7-1ubuntu5.15+esm10
USN-7903-1

Debian

Bug #1121788
python-django
Release Status Fixed Version Urgency
bullseye fixed 2:2.2.28-1~deb11u10 -
bullseye (security) fixed 2:2.2.28-1~deb11u12 -
bookworm fixed 3:3.2.25-0+deb12u1 -
bookworm (security) fixed 3:3.2.25-0+deb12u2 -
trixie (security), trixie fixed 3:4.2.28-0+deb13u1 -
forky, sid fixed 3:4.2.29-1 -
trixie fixed 3:4.2.27-0+deb13u1 -
(unstable) fixed 3:4.2.27-1 -
DLA-4425-1 DSA-6117-1 DSA-6136-1

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Module for Package Hub 15 SP6 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Package Hub 15 SP6 Fixed
openSUSE Leap 15.6 Fixed
openSUSE Leap 16.0 Fixed

References

Advisories & patches
PATCH https://docs.djangoproject.com/en/dev/releases/security/ PATCH https://www.djangoproject.com/weblog/2025/dec/02/security-releases/ ADVISORY https://access.redhat.com/errata/RHSA-2026:0414 ADVISORY https://access.redhat.com/errata/RHSA-2026:1249 ADVISORY https://access.redhat.com/errata/RHSA-2026:1497 ADVISORY https://access.redhat.com/errata/RHSA-2026:1506 ADVISORY https://access.redhat.com/errata/RHSA-2026:1599 ADVISORY https://access.redhat.com/errata/RHSA-2026:1609 ADVISORY https://github.com/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b ADVISORY https://github.com/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5 ADVISORY https://github.com/django/django/commit/4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0 ADVISORY https://github.com/django/django/commit/99e7d22f55497278d0bcb2e15e72ef532e62a31d ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-64460 ADVISORY https://security-tracker.debian.org/tracker/dla-4425-1 ADVISORY https://security-tracker.debian.org/tracker/dsa-6117-1 ADVISORY https://security-tracker.debian.org/tracker/dsa-6136-1 ADVISORY https://ubuntu.com/security/notices/USN-7903-1 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4384/ REF https://groups.google.com/g/django-announce

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy