Vulnerability advisory

CVE-2025-64458

Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

Published Nov 5, 2025Updated Oct 28, 2026OSV record ↗

Also known as BIT-django-2025-64458GHSA-qw25-v68c-qjf3PYSEC-2025-107

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/django/django ↗
97aa3b7f08f51669e118f3af5ca91026e39664c3 to before 0dfd59e2d5c713510c6bcf245e8ac2d5b2043a0a	`0dfd59e2d5c713510c6bcf245e8ac2d5b2043a0a`
84d09a547fe35e10018ab242602ca76c29ca91a1 to before da443c4d5472dfc5afe2567b59123da8372715fe	`da443c4d5472dfc5afe2567b59123da8372715fe`
9e7cc2b628fe8fd3895986af9b7fc9525034c1b0 to before 47fe39af56ecd0ad73b9c7562511015e96b91b80	`47fe39af56ecd0ad73b9c7562511015e96b91b80`
Also listed as affected (8) `5.2.7` `5.2.6` `5.2.5` `5.2.4` `5.2.3` `5.2.2` `5.2.1` `5.2`

Description

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, django.http.HttpResponseRedirect, django.http.HttpResponsePermanentRedirect, and the shortcut django.shortcuts.redirect were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

CVE-2025-64458

Affected versions

Repository

Description

References