{"id":"CVE-2025-64460","aliases":["GHSA-vrcr-9hj9-jcg6","BIT-django-2025-64460","PYSEC-2025-109"],"title":"Django is vulnerable to DoS via XML serializer text extraction","summary":"Django is vulnerable to DoS via XML serializer text extraction","severity":"medium","vendor":"django","product":"django","ecosystem":"pip","affected":["django >= 5.2a1, < 5.2.9","django >= 5.1a1, < 5.1.15","django >= 4.2a1, < 4.2.27"],"patched":["django 5.2.9","django 5.1.15","django 4.2.27"],"published":"2025-12-02","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:32.172789182Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-vrcr-9hj9-jcg6","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64460"},{"url":"https://github.com/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b"},{"url":"https://github.com/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5"},{"url":"https://github.com/django/django/commit/4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0"},{"url":"https://github.com/django/django/commit/99e7d22f55497278d0bcb2e15e72ef532e62a31d"},{"url":"https://docs.djangoproject.com/en/dev/releases/security"},{"url":"https://github.com/django/django"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-109.yaml"},{"url":"https://groups.google.com/g/django-announce"},{"url":"https://www.djangoproject.com/weblog/2025/dec/02/security-releases"}],"tags":["osv","pip"],"epss":0.02085,"epssPercentile":0.80477,"ingestedAt":"2026-09-12T03:13:01.731Z","slug":"CVE-2025-64460","body":"## Overview\n\nAn issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.\nAlgorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.\n\n## Affected packages\n\n- `django >= 5.2a1, < 5.2.9`\n- `django >= 5.1a1, < 5.1.15`\n- `django >= 4.2a1, < 4.2.27`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `django 5.2.9`\n- `django 5.1.15`\n- `django 4.2.27`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}