{"id":"CVE-2025-64460","title":"Django: Django: Algorithmic complexity in XML Deserializer leads to denial of service (CVE-2025-64460)","summary":"A flaw was found in Django. This vulnerability allows a remote attacker to cause a potential denial-of-service (DoS) attack triggering Central Processing Unit (CPU) and memory exhaustion via specially crafted Extensible Markup Language (XM…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-407","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","affected":["ansible_automation_platform_2_4_for_rhel 8","ansible_automation_platform_2_5_for_rhel 8","ansible_automation_platform_2_4_for_rhel 9","ansible_automation_platform_2_5_for_rhel 9","ansible_automation_platform_2_6_for_rhel 9","ansible_automation_platform 2.4","ansible_automation_platform 2.5","discovery 2"],"patched":["ansible_automation_platform_2_4_for_rhel 8","ansible_automation_platform_2_5_for_rhel 8","ansible_automation_platform_2_4_for_rhel 9","ansible_automation_platform_2_5_for_rhel 9","ansible_automation_platform_2_6_for_rhel 9","ansible_automation_platform 2.4","ansible_automation_platform 2.5","discovery 2"],"published":"2025-12-02","updated":"2026-10-16","sourceUpdated":"2026-10-16T10:47:36+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-64460.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-64460.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-64460"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418366"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-64460"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64460"},{"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"url":"https://groups.google.com/g/django-announce"},{"url":"https://www.djangoproject.com/weblog/2025/dec/02/security-releases/"},{"url":"https://access.redhat.com/errata/RHSA-2026:1497"},{"url":"https://access.redhat.com/errata/RHSA-2026:1506"},{"url":"https://access.redhat.com/errata/RHSA-2026:1249"},{"url":"https://access.redhat.com/errata/RHSA-2026:1599"},{"url":"https://access.redhat.com/errata/RHSA-2026:1609"},{"url":"https://access.redhat.com/errata/RHSA-2026:0414"},{"url":"https://github.com/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b"},{"url":"https://github.com/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5"},{"url":"https://github.com/django/django/commit/4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0"},{"url":"https://github.com/django/django/commit/99e7d22f55497278d0bcb2e15e72ef532e62a31d"},{"url":"https://docs.djangoproject.com/en/dev/releases/security"},{"url":"https://github.com/django/django"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-109.yaml"},{"url":"https://www.djangoproject.com/weblog/2025/dec/02/security-releases"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.02085,"epssPercentile":0.8147,"aliases":["GHSA-vrcr-9hj9-jcg6","BIT-django-2025-64460","PYSEC-2025-109"],"ecosystem":"pip","ingestedAt":"2026-09-12T03:13:01.731Z","slug":"CVE-2025-64460","body":"## Overview\n\nA flaw was found in Django. This vulnerability allows a remote attacker to cause a potential denial-of-service (DoS) attack triggering Central Processing Unit (CPU) and memory exhaustion via specially crafted Extensible Markup Language (XML) input processed by the XML Deserializer.\n\n## Vendor advisories\n\n- **RHSA-2026:1497** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9 · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1497)\n- **RHSA-2026:1506** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1506)\n- **RHSA-2026:1249** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-01-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:1249)\n- **RHSA-2026:1599** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.4 · released 2026-01-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:1599)\n- **RHSA-2026:1609** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-01-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:1609)\n- **RHSA-2026:0414** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-01-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:0414)\n\n**Django: Django: Algorithmic complexity in XML Deserializer leads to denial of service** — rated Important by Red Hat. Released 2025-12-02, updated 2026-10-16.\n\nFixed:\n\n- Red Hat Ansible Automation Platform 2.4 for RHEL 8\n- Red Hat Ansible Automation Platform 2.5 for RHEL 8\n- Red Hat Ansible Automation Platform 2.4 for RHEL 9\n- Red Hat Ansible Automation Platform 2.5 for RHEL 9\n- Red Hat Ansible Automation Platform 2.6 for RHEL 9\n- Red Hat Ansible Automation Platform 2.4\n- Red Hat Ansible Automation Platform 2.5\n- Red Hat Discovery 2\n\nNot affected:\n\n- Red Hat Ansible Automation Platform 2.6 for RHEL 10\n- Red Hat Ansible Automation Platform 2.4 for RHEL 8\n- Red Hat Ansible Automation Platform 2.5 for RHEL 8\n- Red Hat Ansible Automation Platform 2.4 for RHEL 9\n- Red Hat Ansible Automation Platform 2.5 for RHEL 9\n- Red Hat Ansible Automation Platform 2.6 for RHEL 9\n- Red Hat Ansible Automation Platform 2.4\n- Red Hat Ansible Automation Platform 2.5\n- Red Hat Discovery 2\n- OpenShift Service Mesh 2\n\n## Remediation\n\nFor details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:1497\nRed Hat Ansible Automation Platform https://access.redhat.com/errata/RHSA-2026:1506\nFor details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:1249\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2025-64460)\n\nAffected packages:\n\n- `django >= 5.2a1, < 5.2.9`\n- `django >= 5.1a1, < 5.1.15`\n- `django >= 4.2a1, < 4.2.27`\n\nPatched in:\n\n- `django 5.2.9`\n- `django 5.1.15`\n- `django 4.2.27`\n\nSource: https://osv.dev/vulnerability/GHSA-vrcr-9hj9-jcg6","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[{"seq":222923,"id":"CVE-2025-64460","ts":1792151703271,"field":"cvss","old":null,"new":"7.5"},{"seq":222922,"id":"CVE-2025-64460","ts":1792151703271,"field":"severity","old":"medium","new":"high"}]}