An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4425 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4425-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     December 29, 2025                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-django     Version        : 2:2.2.28-1~deb11u10     CVE IDs        : CVE-2025-64459 CVE-2025-64460     Debian Bug     : 1121788

    It was discovered that there were two issues in Django, the     Python-based web development framework:

     * CVE-2025-64459: A potential SQL injection via _connector        keyword argument in QuerySet/Q objects. The methods QuerySet        filter(), exclude() and get() as well as the Q() class were        subject to SQL injection when using a suitably crafted dictionary        as the _connector argument.

     * CVE-2025-64460: A potential denial-of-service vulnerability in        XML serializer text extraction. An algorithmic complexity issue in        django.core.serializers.xml_serializer.getInnerText() allowed a        remote attacker to cause a potential denial-of-service triggering        CPU and memory exhaustion via a specially crafted XML input        submitted to a service that invokes XML Deserializer. The        vulnerability resulted from repeated string concatenation while        recursively collecting text nodes, which produced superlinear        computation.

    For Debian 11 bullseye, these problems have been fixed in version     2:2.2.28-1~deb11u10.

    We recommend that you upgrade your python-django packages.

    For the detailed security status of python-django please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-django

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-24dfd3b072 advisory.

    - Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
    - Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
    - Fixes CVE-2025-64459: Potential SQL injection via _connector keyword argument (5.2.8)
    - Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(),       alias(), aggregate(), and extra() on MySQL and MariaDB (5.2.7)
    - Fixes CVE-2025-59682: Potential partial directory-traversal via       archive.extract() (5.2.7)
    - Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation       column aliases (5.2.6)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-b1379d950d advisory.

    - Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
    - Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
    - Fixes CVE-2025-64459: Potential SQL injection via _connector keyword       argument (4.2.26)
    - Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(),       alias(), aggregate(), and extra() on MySQL and MariaDB (4.2.25)
    - Fixes CVE-2025-59682: Potential partial directory-traversal via       archive.extract() (4.2.25)
    - Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation column       aliases (4.2.24)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-45ee190318 advisory.

    - Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
    - Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
    - Fixes CVE-2025-64459: Potential SQL injection via _connector keyword argument (5.2.8)
    - Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(),       alias(), aggregate(), and extra() on MySQL and MariaDB (5.2.7)
    - Fixes CVE-2025-59682: Potential partial directory-traversal via       archive.extract() (5.2.7)
    - Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation       column aliases (5.2.6)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20153-1 advisory.

    - CVE-2025-64459: Fixed a potential SQL injection via `_connector` keyword argument in `QuerySet` and `Q`     objects (bsc#1252926)
    - CVE-2025-13372,CVE-2025-64460: Fixed Denial of Service in     'django.core.serializers.xml_serializer.getInnerText()' (bsc#1254437)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4384-1 advisory.

    - CVE-2025-13372: Fixed SQL Injection in FilteredRelation (bsc#1254437)
    - CVE-2025-64460: Fixed denial of service via specially crafted XML input in       django.core.serializers.xml_serializer.getInnerText() (bsc#1254437)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The detected version of the Django Python package, Django, is 4.2.x prior to 4.2.27, 5.1.x prior to 5.1.15, or 5.2.x prior to 5.2.9. It is, therefore, affected by multiple vulnearabilities as referenced by security release advisory:

  - An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation`     is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary     expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL.     Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be     affected. Django would like to thank Stackered for reporting this issue. (CVE-2025-13372)

  - An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic     complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a     potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input     processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x)     were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this     issue. (CVE-2025-64460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7903-1 advisory.

    It was discovered that Django incorrectly handled certain characters in the FilteredRelation object. An     attacker could possibly use this issue to execute arbitrary SQL commands. This issue only affected Ubuntu     20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-13372)

    Seokchan Yoon discovered that Django inefficiently handled deserialization of XML objects. An attacker     could possibly use this issue to cause Django to use excessive resources, causing a denial of service.
    (CVE-2025-64460)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic     complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a     potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input     processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x)     were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this     issue. (CVE-2025-64460)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
280137	Debian dla-4425 : python-django-doc - security update	Nessus	Debian Local Security Checks	medium
279045	Fedora 43 : python-django5 (2025-24dfd3b072)	Nessus	Fedora Local Security Checks	medium
279042	Fedora 42 : python-django4.2 (2025-b1379d950d)	Nessus	Fedora Local Security Checks	medium
279041	Fedora 42 : python-django5 (2025-45ee190318)	Nessus	Fedora Local Security Checks	medium
278603	openSUSE 16 Security Update : python-Django (openSUSE-SU-2025-20153-1)	Nessus	SuSE Local Security Checks	medium
278598	SUSE SLES15 / openSUSE 15 Security Update : python-Django (SUSE-SU-2025:4384-1)	Nessus	SuSE Local Security Checks	medium
277467	Python Library Django 4.2.x < 4.2.27 / 5.1.x < 5.1.15 / 5.2.x < 5.2.9 Multiple Vulnerabilities	Nessus	Misc.	high
277365	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : Django vulnerabilities (USN-7903-1)	Nessus	Ubuntu Local Security Checks	medium
277088	Linux Distros Unpatched Vulnerability : CVE-2025-64460	Nessus	Misc.	high

Detections

Analytics

CVE-2025-64460

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

medium

high