---
id: CVE-2025-64458
aliases:
  - GHSA-qw25-v68c-qjf3
  - BIT-django-2025-64458
  - PYSEC-2025-107
title: >-
  Django has a denial-of-service vulnerability in HttpResponseRedirect and
  HttpResponsePermanentRedirect on Windows
summary: >-
  Django has a denial-of-service vulnerability in HttpResponseRedirect and
  HttpResponsePermanentRedirect on Windows
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: django
product: django
ecosystem: pip
affected:
  - 'django >= 5.2a1, < 5.2.8'
  - 'django >= 5.0a1, < 5.1.14'
  - django < 4.2.26
patched:
  - django 5.2.8
  - django 5.1.14
  - django 4.2.26
published: '2025-11-05'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:58.508072395Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-qw25-v68c-qjf3'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-64458'
  - url: >-
      https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
  - url: >-
      https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac
  - url: >-
      https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f
  - url: >-
      https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7
  - url: 'https://docs.djangoproject.com/en/dev/releases/security'
  - url: 'https://github.com/django/django'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-107.yaml
  - url: 'https://groups.google.com/g/django-announce'
  - url: 'https://www.djangoproject.com/weblog/2025/nov/05/security-releases'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.01902
epssPercentile: 0.78507
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/ch4n3-yoon/CVE-2025-64458-Demo'
  checkedAt: '2026-09-21T15:27:32.845Z'
exploitAvailable: true
ingestedAt: '2026-09-12T03:13:01.723Z'
---

## Overview

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect`  were subject to a potential  denial-of-service attack via certain inputs with a very large number of Unicode characters.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

## Affected packages

- `django >= 5.2a1, < 5.2.8`
- `django >= 5.0a1, < 5.1.14`
- `django < 4.2.26`

## Remediation

Upgrade to a patched release:

- `django 5.2.8`
- `django 5.1.14`
- `django 4.2.26`