CVE-2025-64460 json
Potential denial-of-service vulnerability in XML serializer text extraction
published 2025-12-02 11 mo ago modified 2026-10-18 21 d ago also BIT-django-2025-64460 , EUVD-2025-200248 , GHSA-vrcr-9hj9-jcg6 , PYSEC-2025-109
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.2%
- EPSS 2.2% chance of exploitation in 30 days, percentile 82%
- public exploits
- 0
- none known
Summary
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
Patch / fix
- pypi django 4.2.27, 5.1.15, 5.2.9
- bitnami django 4.2.27, 5.1.15, 5.2.9
- djangoproject Django 4.2.27, 5.1.15, 5.2.9
- python-django Debian 12 3:3.2.25-0+deb12u1
- python-django Debian 13 3:4.2.27-0+deb13u1
- python-django Debian 14 3:4.2.27-1
debian advisories DEBIAN-CVE-2025-64460
- python-django Ubuntu 22.04 LTS 2:3.2.12-2ubuntu1.24
- python-django Ubuntu 24.04 LTS 3:4.2.11-1ubuntu1.13
- python-django Ubuntu 25.10 3:5.2.4-1ubuntu2.2
- python-django Ubuntu 26.04 LTS 3:5.2.9-0ubuntu1
- python-django Ubuntu Pro 14.04 LTS 1.6.11-0ubuntu1.3+esm9
- python-django Ubuntu Pro 16.04 LTS 1.8.7-1ubuntu5.15+esm10
- python-django Ubuntu Pro 18.04 LTS 1:1.11.11-1ubuntu1.21+esm13
- python-django Ubuntu Pro 20.04 LTS 2:2.2.12-1ubuntu0.29+esm6
ubuntu advisories UBUNTU-CVE-2025-64460
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- receptor ansible automation platform 2.6 1.6.3-2.el10ap
- receptor ansible automation platform inside 2.6, ansible automation platform developer 2.6, ansible automation platform 2.6 1.6.3-2.el9ap
- python3.11-django ansible automation platform developer 2.6, ansible automation platform 2.6 4.2.27-2.el9ap
- python3.11-urllib3 ansible automation platform developer 2.6, ansible automation platform developer 2.5, ansible automation platform 2.6 +1 more 2.6.3-1.el9ap
- python3.11-protobuf ansible automation platform 2.6 4.25.8-1.el9ap
- automation-controller-venv-tower ansible automation platform 2.6 4.7.8-1.el9ap
- receptor ansible automation platform inside 2.5, ansible automation platform inside 2.4, ansible automation platform developer 2.5 +3 more 1.6.3-1.el8ap
- receptor ansible automation platform inside 2.5, ansible automation platform inside 2.4, ansible automation platform developer 2.5 +3 more 1.6.3-1.el9ap
red hat advisories RHSA-2026:1249RHSA-2026:1497RHSA-2026:1506
- python-Django SLE Module for Package Hub 15 SP7, SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 4.2.11-150600.3.44.1
suse advisories SUSE-SU-2025:4384-1
- python-Django5 openSUSE Tumbleweed 5.2.16-1.1
- python-Django6 openSUSE Tumbleweed 6.0-1.1
- python-Django openSUSE Leap 16.0 5.2.4-bp160.4.1
- python-Django openSUSE Tumbleweed 5.2.9-1.1
- python-Django4 openSUSE Tumbleweed 4.2.27-1.1
opensuse advisories openSUSE-SU-2026:11270-1openSUSE-SU-2026:10005-1openSUSE-SU-2025:20153-1openSUSE-SU-2025:15805-1openSUSE-SU-2025:15806-1
- py3-django Alpine 3.24, Alpine 3.23, Alpine 3.22 4.2.27-r0
alpine advisories ALPINE-CVE-2025-64460
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-64460 updated cvss 7.5
Django: Django: Algorithmic complexity in XML Deserializer leads to denial of service
-
Red Hat Ansible Automation Platform 2.4 ansible-automation-platform-24 1768268588fixed: vendor fix RHSA-2026:1599
-
Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower 4.5.30-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower 4.5.30-1.el9apfixed: vendor fix RHSA-2026:1497
-
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25 1768874696fixed: vendor fix RHSA-2026:1609
-
Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.11-django 4.2.27-1.el8ap, automation-controller-venv-tower 4.6.25-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.11-django 4.2.27-1.el9ap, automation-controller-venv-tower 4.6.25-1.el9apfixed: vendor fix RHSA-2026:1506
-
Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.11-django 4.2.27-2.el9ap, automation-controller-venv-tower 4.7.8-1.el9apfixed: vendor fix RHSA-2026:1249
-
Red Hat Discovery 2 discovery 1767888970fixed: vendor fix RHSA-2026:0414
-
Red Hat OpenShift Service Mesh 2 openshift-service-mesh/pilot-rhel8 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-cni-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/de-minimal-rhel8, ansible-automation-platform-24/de-minimal-rhel9, ansible-automation-platform-25/de-minimal-rhel8, ansible-automation-platform-25/de-minimal-rhel9, ansible-automation-platform-26/de-minimal-rhel9, ansible-automation-platform-26/lightspeed-rhel9 Red Hat Ansible Automation Platform 2.4 ansible-automation-platform 1768592146, ansible-automation-platform 1768592150, ansible-automation-platform-24 1768033236, ansible-automation-platform-24 1768033333, ansible-automation-platform-24 1768034162, ansible-automation-platform-24 1768034660, +15 more Red Hat Ansible Automation Platform 2.4 for RHEL 8 receptor 1.6.3-1.el8ap, receptorctl 1.6.3-1.el8ap, automation-controller 4.5.30-1.el8ap, automation-controller-ui 4.5.30-1.el8ap, automation-controller-cli 4.5.30-1.el8ap, automation-controller-server 4.5.30-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 receptor 1.6.3-1.el9ap, receptorctl 1.6.3-1.el9ap, automation-controller 4.5.30-1.el9ap, automation-controller-ui 4.5.30-1.el9ap, automation-controller-cli 4.5.30-1.el9ap, automation-controller-server 4.5.30-1.el9apnot affected: vulnerable code not present
+6 more productsfewer
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform 1768928047, ansible-automation-platform 1768928076, ansible-automation-platform-25 1768814043, ansible-automation-platform-25 1768814199, ansible-automation-platform-25 1768814258, ansible-automation-platform-25 1768814303, +21 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.3-1.el8ap, receptorctl 1.6.3-1.el8ap, ansible-lint 26.1.0-1.el8ap, ansible-core 2.16.15-1.el8ap, ansible-test 2.16.15-1.el8ap, automation-hub 4.10.11-1.el8ap, +15 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.3-1.el9ap, receptorctl 1.6.3-1.el9ap, ansible-lint 26.1.0-1.el9ap, ansible-core 2.16.15-1.el9ap, ansible-test 2.16.15-1.el9ap, automation-hub 4.10.11-1.el9ap, +15 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.3-2.el9ap, receptorctl 1.6.3-2.el9ap, ansible-lint 26.1.0-2.el9ap, ansible-core 2.16.15-1.el9ap, ansible-test 2.16.15-1.el9ap, automation-hub 4.11.5-1.el9ap, +36 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.3-2.el10ap, receptorctl 1.6.3-2.el10ap, ansible-lint 26.1.0-2.el10ap, ansible-core 2.16.15-2.el10ap, python-django 4.2.27-2.el10ap, python3-django 4.2.27-2.el10ap, +3 more Red Hat Discovery 2 discovery 1767904573 -
Red Hat OpenStack Platform 13 (Queens) rhosp13/openstack-horizon Red Hat OpenStack Platform 16.2 rhosp-rhel8/openstack-horizon Red Hat OpenStack Platform 17.1 rhosp-rhel9/openstack-horizon Red Hat OpenStack Platform 18.0 rhoso/openstack-horizon-rhel9 Red Hat Satellite 6 satellite/iop-advisor-backend-rhel9not affected: vulnerable code not in execute path
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 11 mo ago
Exploit prediction
2.16% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | django | >=5.2a1, <5.2.9 >=5.1a1, <5.1.15 >=4.2a1, <4.2.27 >=4.2, <4.2.27 >=5.1, <5.1.15 >=5.2, <5.2.9 |
5.2.9 5.1.15 4.2.27 |
| bitnami | django | >=4.2.0, <4.2.27 >=5.1.0, <5.1.15 >=5.2.0, <5.2.9 |
4.2.27 5.1.15 5.2.9 |
Affected products
- djangoproject Django
Classification
- Weakness
-
- CWE-407 Inefficient Algorithmic Complexity
- Technology feeds
References
-
docs.djangoproject.com
/en/dev/releases/security/
vendor-advisory, patch, advisory
-
djangoproject.com
/weblog/2025/dec/02/security-releases/
vendor-advisory, patch, advisory
-
github.com
/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b
web
-
github.com
/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5
web
-
github.com
/django/django/commit/4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0
web
-
github.com
/django/django/commit/99e7d22f55497278d0bcb2e15e72ef532e62a31d
web
-
groups.google.com
/g/django-announce
mailing-list, web, release-notes, discussion, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-64460
advisory, web
-
docs.djangoproject.com
/en/dev/releases/security
web
-
github.com
/django/django
package
-
github.com
/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-109.yaml
web
-
djangoproject.com
/weblog/2025/dec/02/security-releases
web
-
github.com
/advisories/GHSA-vrcr-9hj9-jcg6
advisory
Sources
- CVE List CVE-2025-64460
- GitHub Advisory GHSA-vrcr-9hj9-jcg6
- NVD CVE-2025-64460
- OSV BIT-django-2025-64460
- OSV PYSEC-2025-109
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.