Executive brief
Django, a popular web framework for building Python applications, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted XML file to a website using Django's XML processing features, causing the server to consume excessive CPU and memory. This can lead to the website becoming slow or completely unavailable to legitimate users.
Technical details
A vulnerability exists in the `django.core.serializers.xml_serializer.getInnerText()` function due to inefficient algorithmic complexity (CWE-407). A remote, unauthenticated attacker can exploit this by submitting specially crafted XML input to be processed by the XML `Deserializer`. Successful exploitation triggers CPU and memory exhaustion, leading to a denial-of-service condition. The issue is fixed in Django versions 5.2.9, 5.1.15, and 4.2.27. Unsupported versions such as 5.0.x and 3.2.x may also be affected but were not evaluated.
Affected products
- Django Software Foundation Django >= 5.2a1, < 5.2.9; >= 5.1a1, < 5.1.15; >= 4.2a1, < 4.2.27
Timeline
- 2025-12-02: disclosed
- 2025-12-02: patched
- 2025-12-02: advisory
References
- https://docs.djangoproject.com/en/dev/releases/security
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2025/dec/02/security-releases
- https://github.com/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b
- https://github.com/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5