CVE-2025-64460
📋 TL;DR
A denial-of-service vulnerability in Django's XML deserializer allows remote attackers to cause CPU and memory exhaustion via specially crafted XML input. This affects Django versions 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27, potentially impacting any Django application that processes XML input.
💻 Affected Systems
- Django
📦 What is this software?
Django by Djangoproject
Django by Djangoproject
Django by Djangoproject
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion, potentially requiring server restart and causing extended downtime.
Likely Case
Degraded performance and intermittent service disruptions affecting application availability.
If Mitigated
Minimal impact with proper input validation and resource limits in place.
🎯 Exploit Status
Attack requires sending specially crafted XML to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.9, 5.1.15, 4.2.27
Vendor Advisory: https://docs.djangoproject.com/en/dev/releases/security/
Restart Required: Yes
Instructions:
1. Update Django using pip: 'pip install --upgrade Django==5.2.9' (or appropriate version). 2. Restart your Django application server. 3. Test XML processing functionality.
🔧 Temporary Workarounds
Disable XML Deserializer
allRemove or disable XML deserialization endpoints if not required.
Implement XML Input Limits
linuxConfigure web server or application to limit XML input size and processing time.
nginx: client_max_body_size 1M;
uwsgi: limit-post 1048576
🧯 If You Can't Patch
- Implement strict XML input validation and size limits at the application level.
- Use web application firewall (WAF) rules to block or limit XML payloads.
🔍 How to Verify
Check if Vulnerable:
Check Django version: 'python -m django --version' or inspect requirements.txt/pip freeze.Check Version:
python -m django --versionVerify Fix Applied:
Confirm Django version is 5.2.9, 5.1.15, or 4.2.27 or higher.📡 Detection & Monitoring
Log Indicators:
- High CPU/memory usage spikes
- XML parsing errors or timeouts
- Large XML payloads in request logs
Network Indicators:
- Unusually large XML requests
- Repeated XML requests to deserialization endpoints
SIEM Query:
source="web_logs" AND (request_body_size>1048576 OR uri_path="*deserialize*" OR content_type="application/xml")