Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-84mm-45p6-xkau
Vulnerability ID VCID-84mm-45p6-xkau
Aliases CVE-2025-64458
GHSA-qw25-v68c-qjf3
Summary Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-407 Inefficient Algorithmic Complexity
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-64458.json
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-64458
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-64458
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-64458
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-64458
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-64458
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-64458
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-64458
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2025-64458
cvssv3.1 7.5 https://docs.djangoproject.com/en/dev/releases/security
generic_textual HIGH https://docs.djangoproject.com/en/dev/releases/security
cvssv3.1 7.5 https://docs.djangoproject.com/en/dev/releases/security/
ssvc Track https://docs.djangoproject.com/en/dev/releases/security/
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-qw25-v68c-qjf3
cvssv3.1 7.5 https://github.com/django/django
generic_textual HIGH https://github.com/django/django
cvssv3.1 7.5 https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
generic_textual HIGH https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
cvssv3.1 7.5 https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac
generic_textual HIGH https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac
cvssv3.1 7.5 https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f
generic_textual HIGH https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f
cvssv3.1 7.5 https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7
generic_textual HIGH https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7
cvssv3.1 7.5 https://groups.google.com/g/django-announce
generic_textual HIGH https://groups.google.com/g/django-announce
ssvc Track https://groups.google.com/g/django-announce
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2025-64458
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2025-64458
cvssv3.1 7.5 https://www.djangoproject.com/weblog/2025/nov/05/security-releases
generic_textual HIGH https://www.djangoproject.com/weblog/2025/nov/05/security-releases
cvssv3.1 7.5 https://www.djangoproject.com/weblog/2025/nov/05/security-releases/
ssvc Track https://www.djangoproject.com/weblog/2025/nov/05/security-releases/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-64458.json
https://api.first.org/data/v1/epss?cve=CVE-2025-64458
https://docs.djangoproject.com/en/dev/releases/security
https://github.com/django/django
https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac
https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f
https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7
https://groups.google.com/g/django-announce
https://www.djangoproject.com/weblog/2025/nov/05/security-releases
2412649 https://bugzilla.redhat.com/show_bug.cgi?id=2412649
CVE-2025-64458 https://nvd.nist.gov/vuln/detail/CVE-2025-64458
GHSA-qw25-v68c-qjf3 https://github.com/advisories/GHSA-qw25-v68c-qjf3
security-releases https://www.djangoproject.com/weblog/2025/nov/05/security-releases/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-64458.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://docs.djangoproject.com/en/dev/releases/security
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://docs.djangoproject.com/en/dev/releases/security/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-11-05T16:20:23Z/ Found at https://docs.djangoproject.com/en/dev/releases/security/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/django/django
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://groups.google.com/g/django-announce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-11-05T16:20:23Z/ Found at https://groups.google.com/g/django-announce
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-64458
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://www.djangoproject.com/weblog/2025/nov/05/security-releases
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://www.djangoproject.com/weblog/2025/nov/05/security-releases/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-11-05T16:20:23Z/ Found at https://www.djangoproject.com/weblog/2025/nov/05/security-releases/
Exploit Prediction Scoring System (EPSS)
Percentile 0.05417
EPSS Score 0.0002
Published At April 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:53:08.466237+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/Django/CVE-2025-64458.yml 38.0.0