CVE-2025-64460
Fixed in a distro release EPSS 2%CVSS 7.5
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
Products: djangoproject django
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 5.2.9 |
| PyPI | django | 5.1.15 |
| PyPI | django | 4.2.27 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | authentik | 2025.10.2-r2 |
| Chainguard | authentik-go-server | 2025.10.2-r2 |
| Chainguard | awx | 24.6.1-r20 |
| Debian 11 | python-django | 2:2.2.28-1~deb11u10 |
| Debian 12 | python-django | 3:3.2.25-0+deb12u1 |
| Debian 13 | python-django | 3:4.2.27-0+deb13u1 |
| Debian 14 | python-django | 3:4.2.27-1 |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.5.30-1.el8ap |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.5.30-1.el9ap |
| Red Hat ansible automation platform 2.4 | receptor | 0:1.6.3-1.el9ap |
| Red Hat ansible automation platform 2.4 | receptor | 0:1.6.3-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.25-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.25-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.11-django | 0:4.2.27-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.11-django | 0:4.2.27-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.11-urllib3 | 0:2.6.3-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.11-urllib3 | 0:2.6.3-1.el8ap |
| Red Hat ansible automation platform 2.5 | receptor | 0:1.6.3-1.el8ap |
| Red Hat ansible automation platform 2.5 | receptor | 0:1.6.3-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-venv-tower | 0:4.7.8-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.11-django | 0:4.2.27-2.el9ap |
| Red Hat ansible automation platform 2.6 | python3.11-protobuf | 0:4.25.8-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.11-protobuf-debuginfo | 0:4.25.8-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.11-protobuf-debugsource | 0:4.25.8-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.11-urllib3 | 0:2.6.3-1.el9ap |
| Red Hat ansible automation platform 2.6 | receptor | 0:1.6.3-2.el10ap |
| Red Hat ansible automation platform 2.6 | receptor | 0:1.6.3-2.el9ap |
| Red Hat ansible automation platform developer 2.4 | receptor | 0:1.6.3-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | receptor | 0:1.6.3-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | python3.11-django | 0:4.2.27-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | python3.11-django | 0:4.2.27-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | python3.11-urllib3 | 0:2.6.3-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | python3.11-urllib3 | 0:2.6.3-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | receptor | 0:1.6.3-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | receptor | 0:1.6.3-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | python3.11-django | 0:4.2.27-2.el9ap |
| Red Hat ansible automation platform developer 2.6 | python3.11-urllib3 | 0:2.6.3-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | receptor | 0:1.6.3-2.el9ap |
| Red Hat ansible automation platform inside 2.4 | receptor | 0:1.6.3-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | receptor | 0:1.6.3-1.el9ap |
| Red Hat ansible automation platform inside 2.5 | receptor | 0:1.6.3-1.el8ap |
| Red Hat ansible automation platform inside 2.5 | receptor | 0:1.6.3-1.el9ap |
| Red Hat ansible automation platform inside 2.6 | receptor | 0:1.6.3-2.el9ap |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | python-Django | 4.2.11-150600.3.44.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | python-Django | 4.2.11-150600.3.44.1 |
| Ubuntu 22.04 LTS | python-django | 2:3.2.12-2ubuntu1.24 |
| Ubuntu 24.04 LTS | python-django | 3:4.2.11-1ubuntu1.13 |
| Ubuntu 25.10 | python-django | 3:5.2.4-1ubuntu2.2 |
| Ubuntu 26.04 LTS | python-django | 3:5.2.9-0ubuntu1 |
| Ubuntu Pro 14.04 LTS | python-django | 1.6.11-0ubuntu1.3+esm9 |
| Ubuntu Pro 16.04 LTS | python-django | 1.8.7-1ubuntu5.15+esm10 |
| Ubuntu Pro 18.04 LTS | python-django | 1:1.11.11-1ubuntu1.21+esm13 |
| Ubuntu Pro 20.04 LTS | python-django | 2:2.2.12-1ubuntu0.29+esm6 |
| openSUSE Leap 15.6 | python-Django | 4.2.11-150600.3.44.1 |
| openSUSE Leap 16.0 | python-Django | 5.2.4-bp160.4.1 |
| openSUSE Tumbleweed | python-Django | 5.2.9-1.1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.27-1.1 |
| openSUSE Tumbleweed | python-Django5 | 5.2.16-1.1 |
| openSUSE Tumbleweed | python-Django6 | 6.0-1.1 |