Denial Of Service (DoS)

🗓️ 13 Dec 2025 07:48:24Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 2 Views

Django Denial of Service via XML deserializer due to inefficient getInnerText, leading to CPU and memory exhaustion.

Reporter	Title	Published	Views	Family All 104
AlpineLinux	CVE-2025-64460	2 Dec 202515:15	–	alpinelinux
AstraLinux	Astra Linux - уязвимость в python-django	3 May 202623:59	–	astralinux
Chainguard	CVE-2025-64460 vulnerabilities	10 Dec 202501:30	–	cgr
Circl	CVE-2025-64460	2 Dec 202514:49	–	circl
CNNVD	Django 安全漏洞	2 Dec 202500:00	–	cnnvd
CVE	CVE-2025-64460	2 Dec 202515:15	–	cve
Cvelist	CVE-2025-64460 Potential denial-of-service vulnerability in XML serializer text extraction	2 Dec 202515:15	–	cvelist
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses django-4.2.26-py3-none-any.whl which are vulnerable to CVE-2025-13372, CVE-2025-64460.	30 Jan 202605:45	–	ibm
Debian	[SECURITY] [DLA 4425-1] python-django security update	30 Dec 202500:03	–	debian
Debian	[SECURITY] [DSA 6117-1] python-django security update	31 Jan 202612:32	–	debian

Vulners

Node

py3-django py3-djangoMatch4.2.26-r0python

AND

alpinelinux alpine_linuxMatch3.23

py3-django py3-djangoMatch3.2.18-r1python

AND

py3-django py3-djangoMatch3.2.15-r0python

AND

py3-django py3-djangoMatch3.1.13-r1python

AND

py3-django py3-djangoMatch1.11.29-r0python

AND

py3-django py3-djangoMatch4.2.10-r0python

AND

py3-django py3-djangoMatch3.2.18-r0python

AND

py3-django py3-djangoMatch4.2.11-r1python

AND

py3-django py3-djangoMatch3.2.12-r0python

AND

py3-django py3-djangoMatch4.2.6-r0python

AND

py3-django py3-djangoMatch3.2.14-r0python

AND

py3-django py3-djangoMatch3.1.7-r1python

AND

py3-django py3-djangoMatch4.2.11-r0python

AND

py3-django py3-djangoMatch4.2.7-r0python

AND

py3-django py3-djangoMatch4.2.21-r0python

AND

py3-django py3-djangoMatch4.2.5-r0python

AND

py3-django py3-djangoMatch4.2-r0python

AND

py3-django py3-djangoMatch3.2.13-r0python

AND

py3-django py3-djangoMatch3.1.13-r0python

AND

py3-django py3-djangoMatch3.2.16-r0python

AND

py3-django py3-djangoMatch3.1.7-r0python

AND

py3-django py3-djangoMatch4.2.25-r0python

AND

py3-django py3-djangoMatch3.1.8-r0python

AND

py3-django py3-djangoMatch4.2-r1python

AND

py3-django py3-djangoMatch4.2.23-r0python

AND

py3-django py3-djangoMatch4.2.12-r0python

AND

py3-django py3-djangoMatch4.2.16-r0python

AND

py3-django py3-djangoMatch4.2.2-r0python

AND

py3-django py3-djangoMatch3.2.17-r0python

AND

py3-django py3-djangoMatch4.2.24-r0python

AND

py3-django py3-djangoMatch4.2.20-r0python

AND

py3-django py3-djangoMatch4.2.26-r0python

AND

py3-django py3-djangoMatch4.2.3-r0python

AND

py3-django py3-djangoMatch3.2.16-r1python

AND

py3-django py3-djangoMatch1.11.28-r0python

AND

py3-django py3-djangoMatch4.2.22-r0python

AND

py3-django py3-djangoMatch4.2.1-r0python

AND

alpinelinux alpine_linuxMatchedge

py3-django py3-djangoMatch4.2.24-r0python

AND

py3-django py3-djangoMatch4.2.23-r0python

AND

py3-django py3-djangoMatch4.2.26-r0python

AND

py3-django py3-djangoMatch4.2.21-r0python

AND

py3-django py3-djangoMatch4.2.25-r0python

AND

alpinelinux alpine_linuxMatch3.22

django_project djangoRange5.2a1–5.2.8python

django_project djangoRange5.1a1–5.1.14python

django_project djangoRange4.2a1–4.2.26python

Source	Link
docs	www.docs.djangoproject.com/en/dev/releases/security/
djangoproject	www.djangoproject.com/weblog/2025/dec/02/security-releases
github	www.github.com/django/django/commit/4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0
github	www.github.com/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5
github	www.github.com/django/django/commit/99e7d22f55497278d0bcb2e15e72ef532e62a31d
groups	www.groups.google.com/g/django-announce
github	www.github.com/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-64460

16 Jan 2026 19:03Current

7High risk

Vulners AI Score7

CVSS 3.17.5

EPSS0.00067

SSVC