CVE-2025-64460: Django XML Deserializer DOS Vulnerability

CVE-2025-64460 Overview

CVE-2025-64460 is a high-severity algorithmic complexity vulnerability discovered in Django's XML serializer component. The vulnerability exists in django.core.serializers.xml_serializer.getInnerText() function and allows remote attackers to cause denial-of-service conditions through CPU and memory exhaustion by submitting specially crafted XML input to the XML Deserializer.

Critical Impact

Remote attackers can trigger severe resource exhaustion (CPU and memory) on servers running affected Django versions by exploiting the algorithmic complexity flaw in XML deserialization, potentially causing complete service disruption.

Affected Products

• Django versions 5.2 before 5.2.9
• Django versions 5.1 before 5.1.15
• Django versions 4.2 before 4.2.27
• Earlier unsupported Django series (5.0.x, 4.1.x, 3.2.x) may also be affected

Discovery Timeline

• 2025-12-02 - Vulnerability discovered and reported by Seokchan Yoon
• 2025-12-02 - Django releases security patches
• 2025-12-02 - CVE CVE-2025-64460 published to NVD
• 2025-12-10 - Last updated in NVD database

Technical Details for CVE-2025-64460

Vulnerability Analysis

This vulnerability is classified as CWE-407 (Inefficient Algorithmic Complexity), which occurs when an algorithm's worst-case performance significantly exceeds average performance. The flaw resides in Django's getInnerText() function within the XML serializer module, which processes XML documents during deserialization operations.

When Django's XML Deserializer encounters specially crafted XML input, the getInnerText() function exhibits inefficient algorithmic behavior that can be deliberately triggered by an attacker. This results in exponential or polynomial time complexity that consumes excessive CPU cycles and memory allocations. Since XML deserialization is commonly used for data import functionality, fixtures loading, and API endpoints accepting XML payloads, the attack surface may be significant for affected applications.

Root Cause

The root cause is inefficient algorithmic complexity in the django.core.serializers.xml_serializer.getInnerText() function. The function's implementation fails to handle certain XML structures efficiently, allowing adversaries to craft input that maximizes processing time and memory consumption. This pattern is commonly seen in recursive or nested parsing operations where the algorithm doesn't properly bound its computational resources relative to input size.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying Django applications that accept XML input through the built-in XML Deserializer
2. Crafting malicious XML payloads designed to trigger worst-case algorithmic behavior in getInnerText()
3. Submitting these payloads to endpoints that process XML data using Django's serialization framework

The vulnerability is particularly concerning for applications that use Django's XML serialization for fixture loading, data import features, or REST APIs that accept XML content types. A successful attack causes the server to consume excessive CPU and memory resources, leading to degraded performance or complete service unavailability.

Detection Methods for CVE-2025-64460

Indicators of Compromise

• Abnormal CPU utilization spikes correlated with XML processing operations
• Increased memory consumption on Django application servers during deserialization tasks
• Application timeouts or worker process crashes when handling XML input
• Elevated response times for endpoints known to process XML data

Detection Strategies

• Monitor Django application performance metrics for anomalous resource consumption during XML operations
• Implement request rate limiting on endpoints that accept XML input to reduce DoS impact
• Configure alerting for unusual patterns in XML payload sizes or request frequencies
• Review application logs for repeated XML deserialization errors or timeout exceptions

Monitoring Recommendations

• Enable detailed logging for Django's serialization framework to capture XML processing events
• Set up infrastructure monitoring to alert on CPU and memory threshold breaches
• Implement application performance monitoring (APM) to track XML deserializer execution times
• Monitor network traffic for large or unusually structured XML payloads targeting Django endpoints

How to Mitigate CVE-2025-64460

Immediate Actions Required

• Upgrade Django to patched versions: 5.2.9, 5.1.15, or 4.2.27 immediately
• Audit application code to identify all endpoints and features using Django's XML Deserializer
• Implement input size limits and request timeouts for XML processing endpoints
• Consider temporarily disabling XML deserialization features if not business-critical

Patch Information

Django has released security updates addressing this vulnerability. Organizations should upgrade to the following fixed versions based on their current Django series:

• Django 5.2 series: Upgrade to version 5.2.9 or later
• Django 5.1 series: Upgrade to version 5.1.15 or later
• Django 4.2 series: Upgrade to version 4.2.27 or later

Detailed patch information and release notes are available through the Django Security Release Notes and Django Weblog Security Releases.

Workarounds

• Implement strict input validation and size limits on all XML input before it reaches the Django deserializer
• Use web application firewall (WAF) rules to detect and block suspicious XML payloads
• Configure resource limits (timeouts, memory caps) for processes handling XML deserialization
• Consider switching to JSON serialization format where XML is not specifically required
• For applications on unsupported Django versions, evaluate upgrading to a supported LTS release

# Example: Upgrade Django to patched version
pip install --upgrade django==5.2.9
# Or for Django 5.1 series
pip install --upgrade django==5.1.15
# Or for Django 4.2 LTS series
pip install --upgrade django==4.2.27