Is CVE-2025-64460 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-64460 being exploited in the wild.

How severe is CVE-2025-64460?

High severity, with a CVSS score of 7.5, published 2 December 2025.

Which products and versions are affected?

Django (PyPI) ECOSYSTEM:introduced=4.2,fixed=4.2.27,introduced=5.1,fixed=5.1.15,introduced=5.2,fixed=5.2.9, ECOSYSTEM:introduced=5.2a1,fixed=5.2.9.

Is there a fix for CVE-2025-64460?

Yes. Django (PyPI): upgrade to 5.2.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-64460 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-64460?

Check whether you run Djangoproject Django or Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64460: Django denial of service in XML serializer text extraction

CVE-2025-64460 · Severity: high · CVSS 7.5 · Published 2025-12-02

Django, a popular web framework for building Python applications, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted XML file to a website using Django's XML processing features, causing the server to consume excessive CPU and memory. This can lead to the website becoming slow or completely unavailable to legitimate users.

Technologies: Djangoproject Django, Django (PyPI). Vendors: Djangoproject, PyPI.

Quick answers

Is CVE-2025-64460 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-64460 being exploited in the wild.
How severe is CVE-2025-64460?: High severity, with a CVSS score of 7.5, published 2 December 2025.
Which products and versions are affected?: Django (PyPI) ECOSYSTEM:introduced=4.2,fixed=4.2.27,introduced=5.1,fixed=5.1.15,introduced=5.2,fixed=5.2.9, ECOSYSTEM:introduced=5.2a1,fixed=5.2.9.
Is there a fix for CVE-2025-64460?: Yes. Django (PyPI): upgrade to 5.2.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64460 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-64460?: Check whether you run Djangoproject Django or Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Django (PyPI): upgrade to 5.2.9 or later
```
pip install "Django>=5.2.9"
```

Technical details

A vulnerability exists in the `django.core.serializers.xml_serializer.getInnerText()` function due to inefficient algorithmic complexity (CWE-407). A remote, unauthenticated attacker can exploit this by submitting specially crafted XML input to be processed by the XML `Deserializer`. Successful exploitation triggers CPU and memory exhaustion, leading to a denial-of-service condition. The issue is fixed in Django versions 5.2.9, 5.1.15, and 4.2.27. Unsupported versions such as 5.0.x and 3.2.x may also be affected but were not evaluated.

Affected products

Django Software Foundation Django >= 5.2a1, < 5.2.9; >= 5.1a1, < 5.1.15; >= 4.2a1, < 4.2.27

Identifiers

CVE-2025-64460
GHSA-vrcr-9hj9-jcg6
PYSEC-2025-109

Timeline

2025-12-02: disclosed
2025-12-02: patched
2025-12-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.