CVE-2025-64460
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
- CVSS 3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-25)
- CWE
- CWE-407
- Published
- Modified
- Record from
- the NVD, synced
Affected
- djangoproject:django
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vrcr-9hj9-jcg6 | PyPI | django | >=5.2a1 <5.2.9 | 5.2.9 |
| GHSA-vrcr-9hj9-jcg6 | PyPI | django | >=5.1a1 <5.1.15 | 5.1.15 |
| GHSA-vrcr-9hj9-jcg6 | PyPI | django | >=4.2a1 <4.2.27 | 4.2.27 |
| PYSEC-2025-109 | PyPI | django | >=4.2 <4.2.27 >=5.1 <5.1.15 >=5.2 <5.2.9 | 4.2.27, 5.1.15, 5.2.9 |