CVE-2025-64458
📋 TL;DR
A denial-of-service vulnerability exists in Django's redirect functions due to inefficient NFKC Unicode normalization on Windows. Attackers can crash Django applications by sending requests with large Unicode payloads to redirect endpoints. This affects Django 5.1 before 5.1.14, 4.2 before 4.2.26, 5.2 before 5.2.8, and potentially earlier unsupported versions.
💻 Affected Systems
- Django
📦 What is this software?
Django by Djangoproject
Django by Djangoproject
Django by Djangoproject
⚠️ Risk & Real-World Impact
Worst Case
Complete application unavailability due to resource exhaustion, requiring service restart and causing extended downtime.
Likely Case
Temporary service degradation or crashes affecting redirect functionality, impacting user experience.
If Mitigated
Minimal impact with proper rate limiting, input validation, and monitoring in place.
🎯 Exploit Status
Attack requires crafting requests with large Unicode payloads to redirect endpoints. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Django 5.1.14, 4.2.26, 5.2.8
Vendor Advisory: https://docs.djangoproject.com/en/dev/releases/security/
Restart Required: Yes
Instructions:
1. Backup your Django application. 2. Update Django using pip: 'pip install Django==5.1.14' (or appropriate version). 3. Restart your Django application server. 4. Test redirect functionality.
🔧 Temporary Workarounds
Rate Limiting
allImplement rate limiting on redirect endpoints to prevent DoS attacks.
Input Validation
allAdd middleware to validate and limit Unicode character length in request parameters.
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block requests with excessive Unicode characters.
- Monitor redirect endpoints for abnormal request patterns and implement alerting.
🔍 How to Verify
Check if Vulnerable:
Check Django version and if using affected redirect functions. Review code for HttpResponseRedirect, HttpResponsePermanentRedirect, or django.shortcuts.redirect usage.Check Version:
python -m django --versionVerify Fix Applied:
After patching, test redirect endpoints with normal Unicode inputs to ensure functionality. Verify Django version is patched.📡 Detection & Monitoring
Log Indicators:
- Multiple requests with large Unicode strings to redirect endpoints
- Increased CPU/memory usage on Django servers
- Application crashes or restarts
Network Indicators:
- HTTP requests with abnormally long Unicode parameters
- High volume of requests to redirect endpoints
SIEM Query:
source="django.logs" AND (uri_path="*redirect*" OR message="*Unicode*") AND bytes_received>10000