CVE-2025-64458 Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
HighCVSS 7.5
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
NFKC normalization in Python is slow on Windows. As a consequence, django.http.HttpResponseRedirect, django.http.HttpResponsePermanentRedirect, and the shortcut django.shortcuts.redirect were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | >= 5.2a1, < 5.2.8 | 5.2.8 |
| pypi django(PyPI) | = 5.2 | No fix listed |
| pypi django(PyPI) | = 5.2.1 | No fix listed |
| pypi django(PyPI) | = 5.2.2 | No fix listed |
| pypi django(PyPI) | = 5.2.3 | No fix listed |
| pypi django(PyPI) | = 5.2.4 | No fix listed |
| pypi django(PyPI) | = 5.2.5 | No fix listed |
| pypi django(PyPI) | = 5.2.6 | No fix listed |
| pypi django(PyPI) | = 5.2.7 | No fix listed |
| pypi django(PyPI) | = 5.2a1 | No fix listed |
| pypi django(PyPI) | = 5.2b1 | No fix listed |
| pypi django(PyPI) | = 5.2rc1 | No fix listed |
| pypi django(PyPI) | >= 5.0a1, < 5.1.14 | 5.1.14 |
| pypi django(PyPI) | = 5.0 | No fix listed |
| pypi django(PyPI) | = 5.0.1 | No fix listed |
| pypi django(PyPI) | = 5.0.10 | No fix listed |
| pypi django(PyPI) | = 5.0.11 | No fix listed |
| pypi django(PyPI) | = 5.0.12 | No fix listed |
| pypi django(PyPI) | = 5.0.13 | No fix listed |
| pypi django(PyPI) | = 5.0.14 | No fix listed |
| pypi django(PyPI) | = 5.0.2 | No fix listed |
| pypi django(PyPI) | = 5.0.3 | No fix listed |
| pypi django(PyPI) | = 5.0.4 | No fix listed |
| pypi django(PyPI) | = 5.0.5 | No fix listed |
| pypi django(PyPI) | = 5.0.6 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi django(PyPI) | = 5.0.7 | No fix listed |
| pypi django(PyPI) | = 5.0.8 | No fix listed |
| pypi django(PyPI) | = 5.0.9 | No fix listed |
| pypi django(PyPI) | = 5.0a1 | No fix listed |
| pypi django(PyPI) | = 5.0b1 | No fix listed |
| pypi django(PyPI) | = 5.0rc1 | No fix listed |
| pypi django(PyPI) | = 5.1 | No fix listed |
| pypi django(PyPI) | = 5.1.1 | No fix listed |
| pypi django(PyPI) | = 5.1.10 | No fix listed |
| pypi django(PyPI) | = 5.1.11 | No fix listed |
| pypi django(PyPI) | = 5.1.12 | No fix listed |
| pypi django(PyPI) | = 5.1.13 | No fix listed |
| pypi django(PyPI) | = 5.1.2 | No fix listed |
| pypi django(PyPI) | = 5.1.3 | No fix listed |
| pypi django(PyPI) | = 5.1.4 | No fix listed |
| pypi django(PyPI) | = 5.1.5 | No fix listed |
| pypi django(PyPI) | = 5.1.6 | No fix listed |
| pypi django(PyPI) | = 5.1.7 | No fix listed |
| pypi django(PyPI) | = 5.1.8 | No fix listed |
| pypi django(PyPI) | = 5.1.9 | No fix listed |
| pypi django(PyPI) | = 5.1a1 | No fix listed |
| pypi django(PyPI) | = 5.1b1 | No fix listed |
| pypi django(PyPI) | = 5.1rc1 | No fix listed |
| pypi django(PyPI) | < 4.2.26 | 4.2.26 |
| pypi django(PyPI) | = 1.0.1 | No fix listed |
| pypi django(PyPI) | = 1.0.2 | No fix listed |
| pypi django(PyPI) | = 1.0.3 | No fix listed |
| pypi django(PyPI) | = 1.0.4 | No fix listed |
| pypi django(PyPI) | = 1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.1 | No fix listed |
| pypi django(PyPI) | = 1.1.2 | No fix listed |
| pypi django(PyPI) | = 1.1.3 | No fix listed |
| pypi django(PyPI) | = 1.1.4 | No fix listed |
| pypi django(PyPI) | = 1.10 | No fix listed |
| pypi django(PyPI) | = 1.10.1 | No fix listed |
| pypi django(PyPI) | = 1.10.2 | No fix listed |
| pypi django(PyPI) | = 1.10.3 | No fix listed |
| pypi django(PyPI) | = 1.10.4 | No fix listed |
| pypi django(PyPI) | = 1.10.5 | No fix listed |
| pypi django(PyPI) | = 1.10.6 | No fix listed |
| pypi django(PyPI) | = 1.10.7 | No fix listed |
| pypi django(PyPI) | = 1.10.8 | No fix listed |
| pypi django(PyPI) | = 1.10a1 | No fix listed |
| pypi django(PyPI) | = 1.10b1 | No fix listed |
| pypi django(PyPI) | = 1.10rc1 | No fix listed |
| pypi django(PyPI) | = 1.11 | No fix listed |
| pypi django(PyPI) | = 1.11.1 | No fix listed |
| pypi django(PyPI) | = 1.11.10 | No fix listed |
| pypi django(PyPI) | = 1.11.11 | No fix listed |
| pypi django(PyPI) | = 1.11.12 | No fix listed |
| pypi django(PyPI) | = 1.11.13 | No fix listed |
| pypi django(PyPI) | = 1.11.14 | No fix listed |
| pypi django(PyPI) | = 1.11.15 | No fix listed |
| pypi django(PyPI) | = 1.11.16 | No fix listed |
| pypi django(PyPI) | = 1.11.17 | No fix listed |
| pypi django(PyPI) | = 1.11.18 | No fix listed |
| pypi django(PyPI) | = 1.11.2 | No fix listed |
| pypi django(PyPI) | = 1.11.20 | No fix listed |
| pypi django(PyPI) | = 1.11.21 | No fix listed |
| pypi django(PyPI) | = 1.11.22 | No fix listed |
| pypi django(PyPI) | = 1.11.23 | No fix listed |
| pypi django(PyPI) | = 1.11.24 | No fix listed |
| pypi django(PyPI) | = 1.11.25 | No fix listed |
| pypi django(PyPI) | = 1.11.26 | No fix listed |
| pypi django(PyPI) | = 1.11.27 | No fix listed |
| pypi django(PyPI) | = 1.11.28 | No fix listed |
| pypi django(PyPI) | = 1.11.29 | No fix listed |
| pypi django(PyPI) | = 1.11.3 | No fix listed |
| pypi django(PyPI) | = 1.11.4 | No fix listed |
| pypi django(PyPI) | = 1.11.5 | No fix listed |
| pypi django(PyPI) | = 1.11.6 | No fix listed |
| pypi django(PyPI) | = 1.11.7 | No fix listed |
| pypi django(PyPI) | = 1.11.8 | No fix listed |
| pypi django(PyPI) | = 1.11.9 | No fix listed |
| pypi django(PyPI) | = 1.11a1 | No fix listed |
| pypi django(PyPI) | = 1.11b1 | No fix listed |
| pypi django(PyPI) | = 1.11rc1 | No fix listed |
| pypi django(PyPI) | = 1.2 | No fix listed |
| pypi django(PyPI) | = 1.2.1 | No fix listed |
| pypi django(PyPI) | = 1.2.2 | No fix listed |
| pypi django(PyPI) | = 1.2.3 | No fix listed |
| pypi django(PyPI) | = 1.2.4 | No fix listed |
| pypi django(PyPI) | = 1.2.5 | No fix listed |
| pypi django(PyPI) | = 1.2.6 | No fix listed |
| pypi django(PyPI) | = 1.2.7 | No fix listed |
| pypi django(PyPI) | = 1.3 | No fix listed |
| pypi django(PyPI) | = 1.3.1 | No fix listed |
| pypi django(PyPI) | = 1.3.2 | No fix listed |
| pypi django(PyPI) | = 1.3.3 | No fix listed |
| pypi django(PyPI) | = 1.3.4 | No fix listed |
| pypi django(PyPI) | = 1.3.5 | No fix listed |
| pypi django(PyPI) | = 1.3.6 | No fix listed |
| pypi django(PyPI) | = 1.3.7 | No fix listed |
| pypi django(PyPI) | = 1.4 | No fix listed |
| pypi django(PyPI) | = 1.4.1 | No fix listed |
| pypi django(PyPI) | = 1.4.10 | No fix listed |
| pypi django(PyPI) | = 1.4.11 | No fix listed |
| pypi django(PyPI) | = 1.4.12 | No fix listed |
| pypi django(PyPI) | = 1.4.13 | No fix listed |
| pypi django(PyPI) | = 1.4.14 | No fix listed |
| pypi django(PyPI) | = 1.4.15 | No fix listed |
| pypi django(PyPI) | = 1.4.16 | No fix listed |
| pypi django(PyPI) | = 1.4.17 | No fix listed |
| pypi django(PyPI) | = 1.4.18 | No fix listed |
| pypi django(PyPI) | = 1.4.19 | No fix listed |
| pypi django(PyPI) | = 1.4.2 | No fix listed |
| pypi django(PyPI) | = 1.4.20 | No fix listed |
| pypi django(PyPI) | = 1.4.21 | No fix listed |
| pypi django(PyPI) | = 1.4.22 | No fix listed |
| pypi django(PyPI) | = 1.4.3 | No fix listed |
| pypi django(PyPI) | = 1.4.4 | No fix listed |
| pypi django(PyPI) | = 1.4.5 | No fix listed |
| pypi django(PyPI) | = 1.4.6 | No fix listed |
| pypi django(PyPI) | = 1.4.7 | No fix listed |
| pypi django(PyPI) | = 1.4.8 | No fix listed |
| pypi django(PyPI) | = 1.4.9 | No fix listed |
| pypi django(PyPI) | = 1.5 | No fix listed |
| pypi django(PyPI) | = 1.5.1 | No fix listed |
| pypi django(PyPI) | = 1.5.10 | No fix listed |
| pypi django(PyPI) | = 1.5.11 | No fix listed |
| pypi django(PyPI) | = 1.5.12 | No fix listed |
| pypi django(PyPI) | = 1.5.2 | No fix listed |
| pypi django(PyPI) | = 1.5.3 | No fix listed |
| pypi django(PyPI) | = 1.5.4 | No fix listed |
| pypi django(PyPI) | = 1.5.5 | No fix listed |
| pypi django(PyPI) | = 1.5.6 | No fix listed |
| pypi django(PyPI) | = 1.5.7 | No fix listed |
| pypi django(PyPI) | = 1.5.8 | No fix listed |
| pypi django(PyPI) | = 1.5.9 | No fix listed |
| pypi django(PyPI) | = 1.6 | No fix listed |
| pypi django(PyPI) | = 1.6.1 | No fix listed |
| pypi django(PyPI) | = 1.6.10 | No fix listed |
| pypi django(PyPI) | = 1.6.11 | No fix listed |
| pypi django(PyPI) | = 1.6.2 | No fix listed |
| pypi django(PyPI) | = 1.6.3 | No fix listed |
| pypi django(PyPI) | = 1.6.4 | No fix listed |
| pypi django(PyPI) | = 1.6.5 | No fix listed |
| pypi django(PyPI) | = 1.6.6 | No fix listed |
| pypi django(PyPI) | = 1.6.7 | No fix listed |
| pypi django(PyPI) | = 1.6.8 | No fix listed |
| pypi django(PyPI) | = 1.6.9 | No fix listed |
| pypi django(PyPI) | = 1.7 | No fix listed |
| pypi django(PyPI) | = 1.7.1 | No fix listed |
| pypi django(PyPI) | = 1.7.10 | No fix listed |
| pypi django(PyPI) | = 1.7.11 | No fix listed |
| pypi django(PyPI) | = 1.7.2 | No fix listed |
| pypi django(PyPI) | = 1.7.3 | No fix listed |
| pypi django(PyPI) | = 1.7.4 | No fix listed |
| pypi django(PyPI) | = 1.7.5 | No fix listed |
| pypi django(PyPI) | = 1.7.6 | No fix listed |
| pypi django(PyPI) | = 1.7.7 | No fix listed |
| pypi django(PyPI) | = 1.7.8 | No fix listed |
| pypi django(PyPI) | = 1.7.9 | No fix listed |
| pypi django(PyPI) | = 1.8 | No fix listed |
| pypi django(PyPI) | = 1.8.1 | No fix listed |
| pypi django(PyPI) | = 1.8.10 | No fix listed |
| pypi django(PyPI) | = 1.8.11 | No fix listed |
| pypi django(PyPI) | = 1.8.12 | No fix listed |
| pypi django(PyPI) | = 1.8.13 | No fix listed |
| pypi django(PyPI) | = 1.8.14 | No fix listed |
| pypi django(PyPI) | = 1.8.15 | No fix listed |
| pypi django(PyPI) | = 1.8.16 | No fix listed |
| pypi django(PyPI) | = 1.8.17 | No fix listed |
| pypi django(PyPI) | = 1.8.18 | No fix listed |
| pypi django(PyPI) | = 1.8.19 | No fix listed |
| pypi django(PyPI) | = 1.8.2 | No fix listed |
| pypi django(PyPI) | = 1.8.3 | No fix listed |
| pypi django(PyPI) | = 1.8.4 | No fix listed |
| pypi django(PyPI) | = 1.8.5 | No fix listed |
| pypi django(PyPI) | = 1.8.6 | No fix listed |
| pypi django(PyPI) | = 1.8.7 | No fix listed |
| pypi django(PyPI) | = 1.8.8 | No fix listed |
| pypi django(PyPI) | = 1.8.9 | No fix listed |
| pypi django(PyPI) | = 1.8a1 | No fix listed |
| pypi django(PyPI) | = 1.8b1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- Django security archive vendor-advisory
- github.com product
- github.com
- Django releases announcements mailing-list technical-description
- Django security releases issued: 5.2.8, 5.1.14, and 4.2.26 vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2025-64458 vendor-advisory
- security.alpinelinux.org vendor-advisory