CVE-2025-64458
Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
Also known as GHSA-qw25-v68c-qjf3, PYSEC-2025-107
Published 12 mo ago · modified 58 d ago · JSON
Summary
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 12 mo ago
Exploit prediction (EPSS)
1.91% probability of exploitation in the next 30 days, higher than 80% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | django | >=5.2a1, <5.2.8 >=5.0a1, <5.1.14 <4.2.26 >=4.2, <4.2.26 >=5.1, <5.1.14 >=5.2, <5.2.8 | 5.2.8 5.1.14 4.2.26 |
Affected products
- djangoproject Django
Classification
- Weakness
- CWE-407 Inefficient Algorithmic Complexity
- Technology feeds
- Django (RSS, critical only)
References
- docs.djangoproject.com /en/dev/releases/security/ · vendor-advisory
- groups.google.com /g/django-announce · mailing-list
- djangoproject.com /weblog/2025/nov/05/security-releases/ · vendor-advisory
- nvd.nist.gov /vuln/detail/CVE-2025-64458 · advisory
- github.com /django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242 · web
- github.com /django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac · web
- github.com /django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f · web
- github.com /django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7 · web
- docs.djangoproject.com /en/dev/releases/security · web
- github.com /django/django · package
- github.com /pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-107.yaml · web
- djangoproject.com /weblog/2025/nov/05/security-releases · web
- github.com /advisories/GHSA-qw25-v68c-qjf3 · advisory
Sources
- CVE List: CVE-2025-64458
- GitHub Advisory: GHSA-qw25-v68c-qjf3
- NVD: CVE-2025-64458
- OSV: PYSEC-2025-107
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.