Resource exhaustion in Django - CVE-2025-64458

Vulnerability identifier: #VU118130

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-64458

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the HttpResponseRedirect, HttpResponsePermanentRedirect, and redirect methods are not optimized on Windows and consume too much system resources. A remote attacker can pass very large number of Unicode characters to the affected methods, trigger resource exhaustion and perform a denial of service (DoS) attack.

Note, the vulnerability affects Windows installations only. 

Django
Storage Defender - Resiliency Service
Maximo Application Suite - Edge Data Collector
openEuler
Anolis OS
python-django-help
python3-Django
python-django
python3-django
python3-django-bash-completion
python3-django-doc

Install updates from vendor's website.

Django - addressed in versions 4.2.26, 5.1.14, 5.2.8
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.24, 9.0.16, 9.1.6
python-django-help - update to 4.2.15-10
python3-Django - update to 4.2.15-10
python-django - update to 4.2.15-10
python3-django - update to 4.2.16-4
python3-django-bash-completion - update to 4.2.16-4
python3-django-doc - update to 4.2.16-4

• https://www.djangoproject.com/weblog/2025/nov/05/security-releases/

• Multiple vulnerabilities in Django
• openEuler 22.03 LTS SP4 update for python-django
• openEuler 22.03 LTS SP3 update for python-django
• openEuler 24.03 LTS SP2 update for python-django
• openEuler 24.03 LTS SP1 update for python-django
• openEuler 24.03 LTS update for python-django
• Anolis OS update for python-django
• Multiple vulnerabilities in IBM Edge Data Collector
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service