CVE-2025-64460High· 7.5▾ TwilightA flaw was found in Django. This vulnerability allows a remote attacker to cause a potential denial-of-service (DoS) attack triggering Central Processing Unit (CPU) and memory exhaustion via specially crafted Extensible Markup Language (XM…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
2.1%
Last analysed / modified upstream
— → 7.5
medium → high
A flaw was found in Django. This vulnerability allows a remote attacker to cause a potential denial-of-service (DoS) attack triggering Central Processing Unit (CPU) and memory exhaustion via specially crafted Extensible Markup Language (XML) input processed by the XML Deserializer.
Django: Django: Algorithmic complexity in XML Deserializer leads to denial of service — rated Important by Red Hat. Released 2025-12-02, updated 2026-10-16.
Fixed:
Not affected:
For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:1497 Red Hat Ansible Automation Platform https://access.redhat.com/errata/RHSA-2026:1506 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:1249
Workarounds / mitigations:
Affected packages:
django >= 5.2a1, < 5.2.9django >= 5.1a1, < 5.1.15django >= 4.2a1, < 4.2.27Patched in:
django 5.2.9django 5.1.15django 4.2.27Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-39373High· 7.5JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)
CVE-2025-6984High· 7.5langchain-community: Langchain-community insecure XML parsing (CVE-2025-6984)
CVE-2025-59530Medium· 5.3github.com/quic-go/quic-go: quic-go Crash Due to Premature HANDSHAKE_DONE Frame (CVE-2025-59530)
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2026-115319Low· 2.5github.com/junegunn/fzf: fzf: Denial of Service via inefficient string concatenation (CVE-2026-115319)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)