Vulnerability details
CVE-2025-64458
djangoproject Django
Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
CVSS 3.1
7.5High
Official description
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| djangoproject | Django | 4.2 ≤ v < 4.2.26 | CVEProject cvelistV5 (CNA) |
| djangoproject | Django | 5.1 ≤ v < 5.1.14 | CVEProject cvelistV5 (CNA) |
| djangoproject | Django | 5.2 ≤ v < 5.2.8 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://docs.djangoproject.com/en/dev/releases/security/ vendor-advisory
- https://groups.google.com/g/django-announce mailing-list
- https://www.djangoproject.com/weblog/2025/nov/05/security-releases/ vendor-advisory
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-11-05
- Last updated
- 2025-11-05
- State
- Published
- Assigner (CNA)
- DSF
Exploit prediction (EPSS)
1.9%
Probability of exploitation in 30 days
79.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-407Inefficient Algorithmic Complexity