CVE-2025-64458

{"id": "CVE-2025-64458", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64458", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-05T16:20:23.751041Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "affectedData": [{"repo": "https://github.com/django/django/", "vendor": "djangoproject", "product": "Django", "versions": [{"status": "affected", "version": "5.2", "lessThan": "5.2.8", "versionType": "semver"}, {"status": "unaffected", "version": "5.2.8", "versionType": "semver"}, {"status": "affected", "version": "5.1", "lessThan": "5.1.14", "versionType": "semver"}, {"status": "unaffected", "version": "5.1.14", "versionType": "semver"}, {"status": "affected", "version": "4.2", "lessThan": "4.2.26", "versionType": "semver"}, {"status": "unaffected", "version": "4.2.26", "versionType": "semver"}], "packageName": "django", "collectionURL": "https://pypi.org/project/Django/", "defaultStatus": "unaffected"}]}], "published": "2025-11-05T15:15:40.940", "references": [{"url": "https://docs.djangoproject.com/en/dev/releases/security/", "tags": ["Vendor Advisory"], "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}, {"url": "https://groups.google.com/g/django-announce", "tags": ["Mailing List"], "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}, {"url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases/", "tags": ["Vendor Advisory"], "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "description": [{"lang": "en", "value": "CWE-407"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.\nNFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en 5.1 anterior a 5.1.14, 4.2 anterior a 4.2.26 y 5.2 anterior a 5.2.8. La normalizaci\u00f3n NFKC en Python es lenta en Windows. Como consecuencia, 'django.http.HttpResponseRedirect', 'django.http.HttpResponsePermanentRedirect' y el atajo 'django.shortcuts.redirect' estuvieron sujetos a un potencial ataque de denegaci\u00f3n de servicio a trav\u00e9s de ciertas entradas con un n\u00famero muy grande de caracteres Unicode. Series de Django anteriores y no compatibles (como 5.0.x, 4.1.x y 3.2.x) no fueron evaluadas y tambi\u00e9n pueden estar afectadas. Django desea agradecer a Seokchan Yoon por informar este problema."}], "lastModified": "2026-06-17T09:54:24.323", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5FC7EBE0-A60A-4083-9FB7-E4ADCD2B5F37", "versionEndExcluding": "4.2.26", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F3A5471-02DB-428E-815E-516057A901FF", "versionEndExcluding": "5.1.14", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F56E9016-F93A-4DAE-8070-D3A4909F00A4", "versionEndExcluding": "5.2.8", "versionStartIncluding": "5.2"}], "operator": "OR"}]}], "sourceIdentifier": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}