CVE-2025-14550: Django Denial-of-Service Vulnerability via Duplicate Headers
Summary
CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI. Affects django across 3 version ranges.
>= 4.2.0, < 4.2.28
>= 5.2.0, < 5.2.11
>= 6.0.0, < 6.0.2
Fixed in 4.2.28, 5.2.11 or 6.0.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-14550 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and offers features such as an ORM, routing, and templating. However, certain versions of Django are vulnerable to a denial-of-service attack when handling ASGI requests with multiple duplicate headers, which can lead to service disruption.
Vulnerability Detail
An issue was discovered in Django versions 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The vulnerability arises from the ASGIRequest component, which allows a remote attacker to craft a request containing multiple duplicate headers. This can lead to a denial-of-service condition, potentially overwhelming the server and making it unresponsive. Unsupported Django series like 5.0.x, 4.1.x, and 3.2.x may also be affected, although they were not evaluated.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.2.0, < 4.2.284.2.28 -
>= 5.2.0, < 5.2.115.2.11 -
>= 6.0.0, < 6.0.26.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing a reverse proxy that can filter out or limit the number of duplicate headers in incoming requests. This can help mitigate the risk of denial-of-service attacks until a proper update can be applied.
Conclusion
The CVE-2025-14550 vulnerability presents a significant risk to applications using affected versions of Django. It is crucial to update to the latest patched versions to ensure the security and stability of your applications. Implementing workarounds can provide temporary relief, but a proper upgrade is the best long-term solution.
See every vulnerability recorded for django →
FAQ
CVE-2025-14550 is a vulnerability in Django that allows for potential denial-of-service attacks via crafted requests with multiple duplicate headers.
Django versions 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28 are affected. Unsupported versions may also be vulnerable.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot upgrade right away, consider using a reverse proxy to filter out duplicate headers in requests as a temporary workaround.
The vulnerability was reported by Jiyong Yang, who identified the potential denial-of-service issue in Django.
Related vulnerabilities
Recent vulnerabilities recorded for django.
