{"action":"Upgrade django to 4.2.27 or later.","affected":[{"fixed":"5.2.9","introduced":"5.2a1"},{"fixed":"5.1.15","introduced":"5.1a1"},{"fixed":"4.2.27","introduced":"4.2a1"}],"component":"django","cve_ids":["CVE-2025-64460"],"ecosystem":"PyPI","epss":0.02085,"exploited":false,"fixed_versions":["5.2.9","5.1.15","4.2.27"],"ghsa_id":"GHSA-vrcr-9hj9-jcg6","id":"tcs_01M5KG0SEZ3Z73TPS1GA5AX4A2","modified_at":"2026-09-10T03:50:32.172789182Z","published_at":"2025-12-02T18:30:35Z","references":["https://osv.dev/vulnerability/GHSA-vrcr-9hj9-jcg6","https://nvd.nist.gov/vuln/detail/CVE-2025-64460","https://github.com/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b","https://github.com/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5","https://github.com/django/django/commit/4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0","https://github.com/django/django/commit/99e7d22f55497278d0bcb2e15e72ef532e62a31d","https://docs.djangoproject.com/en/dev/releases/security","https://github.com/django/django","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-109.yaml","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2025/dec/02/security-releases"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-vrcr-9hj9-jcg6","url":"https://osv.dev/vulnerability/GHSA-vrcr-9hj9-jcg6"}],"summary":"Django is vulnerable to DoS via XML serializer text extraction"}