PT-2025-45118 · Django · Django

Jacob Walls

+2

·

Published

2025-11-05

·

Updated

2026-03-10

·

CVE-2025-64458

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions Django versions prior to 4.2.26 Django versions prior to 5.1.14 Django versions prior to 5.2.8 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier
Description The issue relates to algorithmic complexity within the django.http.HttpResponseRedirect() and django.http.HttpResponsePermanentRedirect() functions, and the django.shortcuts.redirect shortcut. The slow performance of NFKC normalization in Python on Windows can be exploited to trigger a denial-of-service (DoS) condition by providing specially crafted inputs containing a large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected.
Recommendations Upgrade to Django version 4.2.26 or later. Upgrade to Django version 5.1.14 or later. Upgrade to Django version 5.2.8 or later. Upgrade to a newer version of Django that addresses this issue if using versions 5.0.x, 4.1.x, or 3.2.x.

Fix

DoS

Weakness Enumeration

Related Identifiers

BDU:2025-14003
BIT-DJANGO-2025-64458
CVE-2025-64458
ECHO-879A-FE35-CF61
GHSA-QW25-V68C-QJF3
OESA-2025-2676
OESA-2025-2677
OESA-2025-2678
OESA-2025-2679
OESA-2025-2680
PYSEC-2025-107

Affected Products

Django