An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

The detected version of the Django Python package, Django, is 4.2.x prior to 4.2.27, 5.1.x prior to 5.1.15, or 5.2.x prior to 5.2.9. It is, therefore, affected by multiple vulnearabilities as referenced by security release advisory:

  - An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation`     is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary     expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL.     Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be     affected. Django would like to thank Stackered for reporting this issue. (CVE-2025-13372)

  - An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic     complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a     potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input     processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x)     were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this     issue. (CVE-2025-64460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7903-1 advisory.

    It was discovered that Django incorrectly handled certain characters in the FilteredRelation object. An     attacker could possibly use this issue to execute arbitrary SQL commands. This issue only affected Ubuntu     20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-13372)

    Seokchan Yoon discovered that Django inefficiently handled deserialization of XML objects. An attacker     could possibly use this issue to cause Django to use excessive resources, causing a denial of service.
    (CVE-2025-64460)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic     complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a     potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input     processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x)     were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this     issue. (CVE-2025-64460)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
277467	Python Library Django 4.2.x < 4.2.27 / 5.1.x < 5.1.15 / 5.2.x < 5.2.9 Multiple Vulnerabilities	Nessus	Misc.	high
277365	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : Django vulnerabilities (USN-7903-1)	Nessus	Ubuntu Local Security Checks	medium
277088	Linux Distros Unpatched Vulnerability : CVE-2025-64460	Nessus	Misc.	high

Detections

Analytics

CVE-2025-64460

medium

Tenable Plugins

high

medium

high