CVE-2025-64460

score

<0.1

cvss

7.5

epss

2.1%

published

2025-12-02

kev added

—

first seen

2026-10-21

Django < 5.2.9, < 5.1.15, and < 4.2.27 contain a denial-of-service vulnerability caused by algorithmic complexity in django.core.serializers.xml_serializer.getInnerText(), letting remote attackers exhaust CPU and memory via crafted XML input, exploit requires sending malicious XML to the Deserializer.