CVE-2025-64460: 
Django vulnerability analysis and mitigation

CVE-2025-64460 is a denial-of-service vulnerability in Django's XML serializer caused by inefficient algorithmic complexity in django.core.serializers.xml_serializer.getInnerText(). A remote, unauthenticated attacker can send specially crafted XML input to the XML Deserializer to trigger excessive CPU and memory consumption. Affected versions include Django 4.2 before 4.2.27, 5.1 before 5.1.15, and 5.2 before 5.2.9; earlier unsupported series (5.0.x, 4.1.x, 3.2.x) were not evaluated but may also be affected. The vulnerability was disclosed on December 2, 2025, and was reported by researcher Seokchan Yoon. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Django Security Releases).

The root cause is classified as CWE-407 (Inefficient Algorithmic Complexity): the getInnerText() function in Django's XML serializer does not bound or optimize its text extraction logic, allowing an attacker to craft XML input that triggers worst-case computational behavior. The attack vector is network-based, requires no authentication or user interaction, and targets any Django application endpoint that processes XML-deserialized data. An attacker submits a specially crafted XML document — for example, deeply nested or excessively large text nodes — that causes the deserializer to consume disproportionate CPU and memory resources. Patch commits are publicly available in the Django repository (GitHub Advisory, Django Security Releases).

Successful exploitation results in a denial-of-service condition, causing high availability impact with no effect on confidentiality or integrity. An attacker can render the affected Django application unresponsive by exhausting server CPU and memory resources, disrupting service for all legitimate users. The attack requires no privileges or user interaction and can be launched from anywhere on the network, making it particularly accessible to opportunistic attackers (GitHub Advisory, Django Security Releases).

No public proof-of-concept exploit code has been confirmed, though exploitation has been reported by various sources including cyberhub.blog (GitHub Advisory). The EPSS score is approximately 0.036% (0.000360), indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported. The vulnerability is detectable by multiple scanners including Nessus and Qualys.

1. Reconnaissance: Identify Django applications that expose endpoints accepting XML-deserialized input (e.g., APIs or admin interfaces using Django's XML fixture/serializer functionality), targeting versions 4.2 < 4.2.27, 5.1 < 5.1.15, or 5.2 < 5.2.9.
2. Craft malicious XML payload: Construct a specially crafted XML document designed to trigger worst-case algorithmic complexity in getInnerText(), such as deeply nested XML elements or extremely large text node structures that force repeated recursive or iterative text extraction.
3. Submit payload: Send the crafted XML input to the target application endpoint that invokes Django's XML Deserializer, via an HTTP POST request or other applicable input channel.
4. Trigger resource exhaustion: The getInnerText() function processes the malicious XML, consuming excessive CPU cycles and memory, causing the server process to slow significantly or become unresponsive.
5. Sustain DoS: Repeat requests as needed to maintain resource exhaustion and prevent service recovery, effectively denying access to legitimate users (GitHub Advisory, Django Security Releases).

• Network: Unusual or repeated HTTP requests containing large or deeply nested XML payloads sent to endpoints that invoke Django's XML deserializer; high-volume requests from a single or small set of source IPs targeting XML-processing endpoints.
• Logs: Django application logs showing repeated or long-running XML deserialization operations; HTTP 500 errors or timeouts associated with XML processing endpoints; access logs with abnormally large request body sizes.
• Process/System: Sustained high CPU utilization by the Django/Python worker process(es); rapid memory growth in the application server process; system monitoring alerts for resource exhaustion (CPU > 90%, memory near capacity) correlated with incoming XML requests.

Django has released patched versions addressing this vulnerability: 4.2.27, 5.1.15, and 5.2.9 — upgrading to one of these is the primary recommended remediation (Django Security Releases). If immediate upgrade is not possible, consider the following interim mitigations: (1) disable XML deserialization functionality if not required; (2) implement input validation to limit XML payload size and nesting depth before it reaches the deserializer; (3) deploy WAF rules to filter or rate-limit requests with suspicious XML content; (4) monitor system resource usage and set alerts for anomalous CPU/memory spikes. Unsupported Django series (5.0.x, 4.1.x, 3.2.x) should be upgraded to a supported and patched release.

The Django project credited researcher Seokchan Yoon for responsibly reporting the issue and published a security advisory alongside the patched releases on December 2, 2025 (Django Security Releases). Multiple security news outlets including CyberSecurityNews, GBHackers, and HealSecurity covered the vulnerability as part of broader reporting on multiple Django security issues disclosed simultaneously. Ubuntu, Debian, Fedora, SUSE, Mageia, and Red Hat all issued downstream security advisories and package updates. The Django security team also published a follow-up blog post in February 2026 discussing recent security trends (Django Security Blog).