CVE-2025-64460: Django Denial-of-Service Vulnerability via XML Serializer
Summary
CVE-2025-64460: Django is vulnerable to DoS via XML serializer text extraction. Affects django across 3 version ranges.
>= 4.2a1, < 4.2.27
>= 5.1a1, < 5.1.15
>= 5.2a1, < 5.2.9
Fixed in 4.2.27, 5.1.15 or 5.2.9, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
The same CVE-2025-64460 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, routing, authentication, and templating. However, certain versions of Django are vulnerable to a denial-of-service attack due to algorithmic complexity in its XML serializer, which can be exploited by specially crafted XML input.
Vulnerability Detail
An issue was discovered in Django versions 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. The vulnerability arises from the getInnerText() method in the django.core.serializers.xml_serializer module, which can lead to CPU and memory exhaustion when processing malicious XML input. This could allow a remote attacker to cause a denial-of-service condition, impacting the availability of the application. Unsupported versions, such as 5.0.x, 4.1.x, and 3.2.x, may also be affected but were not evaluated.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2a1, < 4.2.274.2.27pip install --upgrade "django==4.2.27" -
>= 5.1a1, < 5.1.155.1.15pip install --upgrade "django==5.1.15" -
>= 5.2a1, < 5.2.95.2.9pip install --upgrade "django==5.2.9"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot immediately upgrade, consider implementing input validation to reject malformed XML input or limit the size of XML payloads processed by your application to mitigate the risk of denial-of-service attacks.
Conclusion
The vulnerability identified as CVE-2025-64460 poses a significant risk to certain versions of Django, allowing for potential denial-of-service attacks through malicious XML input. It is crucial for users to update to the latest patched versions to mitigate this risk and ensure the security and availability of their applications.
See every vulnerability recorded for django →
FAQ
Django versions 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27 are affected. Unsupported versions may also be at risk.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
A denial-of-service attack is an attempt to make a machine or network resource unavailable to its intended users, often by overwhelming it with traffic or resource-intensive requests.
If you cannot upgrade immediately, implement input validation to reject malformed XML input or limit the size of XML payloads processed by your application.
The vulnerability was reported by Seokchan Yoon, who identified the potential for denial-of-service attacks through the XML serializer.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
