CVE-2025-64460
published 2025-12-02CVE-2025-64460: An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.11%
79.4th percentile
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-django | < python-django 3:3.2.25-0+deb12u1 (bookworm) | python-django 3:3.2.25-0+deb12u1 (bookworm) |
| djangoproject | django | >= 4.2 < 4.2.27 | 4.2.27 |
| djangoproject | django | >= 4.2a1 < 4.2.27 | 4.2.27 |
| djangoproject | django | >= 5.1 < 5.1.15 | 5.1.15 |
| djangoproject | django | >= 5.1a1 < 5.1.15 | 5.1.15 |
| djangoproject | django | >= 5.2 < 5.2.9 | 5.2.9 |
| djangoproject | django | >= 5.2a1 < 5.2.9 | 5.2.9 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Django vulnerabilities
vendor_ubuntu·2025-12-02·CVSS 4.3
CVE-2025-64460 [MEDIUM] Django vulnerabilities
Title: Django vulnerabilities
Summary: Several security issues were fixed in Django.
It was discovered that Django incorrectly handled certain characters in the
FilteredRelation object. An attacker could possibly use this issue to
execute arbitrary SQL commands. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10.
(CVE-2025-13372)
Seokchan Yoon discovered that Django inefficiently handled deserialization
of XML objects. An attacker could possibly use this issue to cause Django
to use excessive resources, causing a denial of service. (CVE-2025-64460)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
Django: Django: Algorithmic complexity in XML Deserializer leads to denial of service
vendor_redhat·2025-12-02·CVSS 7.5
CVE-2025-64460 [HIGH] CWE-407 Django: Django: Algorithmic complexity in XML Deserializer leads to denial of service
Django: Django: Algorithmic complexity in XML Deserializer leads to denial of service
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.
A flaw was found in Django. This vulnerability allows a remote attacker to cause a potential denial-of-service (DoS) attack triggering Central Processing Unit (CPU) and memory exhaustio
Debian
CVE-2025-64460: python-django - An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4...
vendor_debian·2025·CVSS 7.5
CVE-2025-64460 [HIGH] CVE-2025-64460: python-django - An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4...
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
Scope: local
bookworm: resolved (fixed in 3:3.2.25-0+deb12u1)
bullseye: resolved (fixed in 2:2.2.28-1~deb11u10)
forky: resolved (fixed in 3:4.2.27-1)
sid: resolved (fixed in 3:4.2.27-1)
trixie: resolved (fixed in 3:4.2.27-0+deb13u1)
OSV
Django is vulnerable to DoS via XML serializer text extraction
osv·2025-12-02
CVE-2025-64460 [MEDIUM] Django is vulnerable to DoS via XML serializer text extraction
Django is vulnerable to DoS via XML serializer text extraction
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.
OSV
CVE-2025-64460: An issue was discovered in 5
osv·2025-12-02·CVSS 7.5
CVE-2025-64460 [HIGH] CVE-2025-64460: An issue was discovered in 5
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
OSV
python-django vulnerabilities
osv·2025-12-02·CVSS 4.3
CVE-2025-13372 [MEDIUM] python-django vulnerabilities
python-django vulnerabilities
It was discovered that Django incorrectly handled certain characters in the
FilteredRelation object. An attacker could possibly use this issue to
execute arbitrary SQL commands. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10.
(CVE-2025-13372)
Seokchan Yoon discovered that Django inefficiently handled deserialization
of XML objects. An attacker could possibly use this issue to cause Django
to use excessive resources, causing a denial of service. (CVE-2025-64460)
GHSA
Django is vulnerable to DoS via XML serializer text extraction
ghsa·2025-12-02
CVE-2025-64460 [MEDIUM] CWE-407 Django is vulnerable to DoS via XML serializer text extraction
Django is vulnerable to DoS via XML serializer text extraction
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-12-02
Published