PyPI/django CVE-2025-64460: medium, EPSS 2.08%

Django is vulnerable to DoS via XML serializer text extraction

Action: Upgrade django to 4.2.27 or later.

pip install django==5.2.9

pip install django==5.1.15

pip install django==4.2.27

Affected

Fixed versions

Sources

• osv: GHSA-vrcr-9hj9-jcg6
• https://nvd.nist.gov/vuln/detail/CVE-2025-64460
• https://github.com/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b
• https://github.com/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5
• https://github.com/django/django/commit/4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0
• https://github.com/django/django/commit/99e7d22f55497278d0bcb2e15e72ef532e62a31d
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-109.yaml
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/dec/02/security-releases

CVE-2025-64460 · published 2025-12-02T18:30:35Z · modified 2026-09-10T03:50:32.172789182Z · JSON