Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-407.
Summary
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| djangoproject | Django | 5.2 to before 5.2.8; 5.1 to before 5.1.14; 4.2 to before 4.2.26 | 5.2.8, 5.1.14, 4.2.26 | Patch available | CNA |
| — | django (PyPI) | 5.2a1 to before 5.2.8 | 5.2.8 | Patch available | GHSA-qw25-v68c-qjf3 |
| — | django (PyPI) | 5.0a1 to before 5.1.14 | 5.1.14 | Patch available | GHSA-qw25-v68c-qjf3 |
| — | django (PyPI) | before 4.2.26 | 4.2.26 | Patch available | GHSA-qw25-v68c-qjf3 |
- Django Vendordjangoproject Affected 5.2 to before 5.2.8; 5.1 to before 5.1.14; 4.2 to before 4.2.26 Fixed in 5.2.8, 5.1.14, 4.2.26 Patch available CNA
- django (PyPI) Vendor— Affected 5.2a1 to before 5.2.8 Fixed in 5.2.8 Patch available GHSA-qw25-v68c-qjf3
- django (PyPI) Vendor— Affected 5.0a1 to before 5.1.14 Fixed in 5.1.14 Patch available GHSA-qw25-v68c-qjf3
- django (PyPI) Vendor— Affected before 4.2.26 Fixed in 4.2.26 Patch available GHSA-qw25-v68c-qjf3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* | 4.2 to before 4.2.26; 5.1 to before 5.1.14; 5.2 to before 5.2.8 | Vulnerable | djangoproject |
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions 4.2 to before 4.2.26; 5.1 to before 5.1.14; 5.2 to before 5.2.8 Vulnerable ·djangoproject
Remediation
- Fix · CNA Django (djangoproject) Fixed in 5.2.8, 5.1.14, 4.2.26
- Fix · GHSA-qw25-v68c-qjf3 django (PyPI) Fixed in 5.2.8 Advisory →
- Fix · GHSA-qw25-v68c-qjf3 django (PyPI) Fixed in 5.1.14 Advisory →
- Fix · GHSA-qw25-v68c-qjf3 django (PyPI) Fixed in 4.2.26 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
djangoproject Django — Django security releases issued: 5.2.8, 5.1.14, and 4.2.26
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2025-39861 Potential SQL injection via _connector keyword argument in QuerySet and Q objectsPriority HIGH 65
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 10 products
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Red Hat Ansible Automation Platform 2
- Red Hat Discovery 1
- Red Hat Discovery 2
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2025-64458
- 2026-10-03 Alias added: GHSA-qw25-v68c-qjf3
References
Advisory 3
Other 9
- Django releases announcements
- https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
- https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac
- https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f
- https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7
- https://docs.djangoproject.com/en/dev/releases/security
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-107.yaml
- https://www.djangoproject.com/weblog/2025/nov/05/security-releases
More djangoproject Django vulnerabilities
- TI-2022-15177 An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. CVSS 3.1CRITICAL 9.8
- TI-2020-05994 Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection… CVSS 3.1CRITICAL 9.8
- TI-2023-10198 An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0… CVSS 3.1HIGH 7.5
- TI-2019-14306 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. CVSS 3.1CRITICAL 9.8
- TI-2019-10595 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x… CVSS 3.0CRITICAL 9.8
- TI-2021-14006 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-64458 · CVE Program
- CVE-2025-64458 · NVD
- FIRST EPSS
- GHSA-qw25-v68c-qjf3 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-64458 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences