An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization
    in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`,
    `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to
    a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
    Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be
    affected. Django would like to thank Seokchan Yoon for reporting this issue. (CVE-2025-64458)

  - An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods
    `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL
    injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector`
    argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may
    also be affected. Django would like to thank cyberstan for reporting this issue. (CVE-2025-64459)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization
    in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`,
    `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to
    a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
    Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be
    affected. Django would like to thank Seokchan Yoon for reporting this issue. (CVE-2025-64458)

ID	Name	Product	Family	Severity
436035	Alpine: multiple py3-django packages: security update to 4.2.26-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
436035	Alpine: multiple py3-django packages: security update to 4.2.26-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
435945	SCA: security update for django (GHSA-qw25-v68c-qjf3)	Tenable Cloud Security	SCA Checks	high
435945	SCA: security update for django (GHSA-qw25-v68c-qjf3)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2025-64458

high

Tenable Plugins

critical

critical

high

high