Vulnerability advisory

CVE-2025-64460

Potential denial-of-service vulnerability in XML serializer text extraction

Published Dec 2, 2025Updated Oct 28, 2026OSV record ↗

Also known as BIT-django-2025-64460GHSA-vrcr-9hj9-jcg6PYSEC-2025-109

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/django/django ↗
97aa3b7f08f51669e118f3af5ca91026e39664c3 to before 5948e6657f8cb6aeaab1a5a45640d089230f461a	`5948e6657f8cb6aeaab1a5a45640d089230f461a`
84d09a547fe35e10018ab242602ca76c29ca91a1 to before 6ef1f6fbe33e9882f82dae026b527800ecb78c36	`6ef1f6fbe33e9882f82dae026b527800ecb78c36`
9e7cc2b628fe8fd3895986af9b7fc9525034c1b0 to before c14b756185c88f7f2eb745ff061f3c221fea9de7	`c14b756185c88f7f2eb745ff061f3c221fea9de7`
Also listed as affected (9) `5.2.8` `5.2.7` `5.2.6` `5.2.5` `5.2.4` `5.2.3` `5.2.2` `5.2.1` `5.2`

Description

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in django.core.serializers.xml_serializer.getInnerText() allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML Deserializer. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

CVE-2025-64460

Affected versions

Repository

Description

References