Loading story…
A denial-of-service vulnerability tracked as CVE-2025-26699 was disclosed in Django's django.utils.text.wrap() function and the wordwrap template filter, where processing extremely long strings can trigger excessive resource consumption and disrupt application availability. The issue is classified as CWE-400 and affects availability rather than confidentiality or integrity.
Red Hat rated the flaw Moderate with a CVSS v3 score of 7.5 and published fixes for multiple downstream products, including Discovery for RHEL 9 and several Red Hat Ansible Automation Platform 2.4 and 2.5 components. Red Hat said no qualifying mitigation was available at the time of disclosure, while Django's security documentation remains the upstream reference point for project security handling and advisories.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2025:3709 to fix CVE-2025-26699 in Discovery 1 for RHEL 9 discovery-server-rhel9.
Red Hat released RHSA-2025:3160 and RHSA-2025:3162 with fixes for affected Red Hat Ansible Automation Platform 2.5 components on RHEL 8 and RHEL 9, including python3.11-django and lightspeed-related packages.
Red Hat publicly disclosed CVE-2025-26699, a Django denial-of-service flaw in django.utils.text.wrap() and the wordwrap template filter that can exhaust resources when processing extremely long strings.
Red Hat last modified its CVE-2025-26699 advisory, reflecting an update to the public record for the Django denial-of-service vulnerability.
Red Hat released RHSA-2025:8609 to address CVE-2025-26699 in Red Hat Ansible Automation Platform 2.4 Django packages for RHEL 8 and RHEL 9.
Red Hat released RHSA-2025:4553 addressing CVE-2025-26699 in Red Hat Ansible Automation Platform 2.5 automation-controller packages for RHEL 8 and RHEL 9.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Django issued security releases `5.2.9`, `5.1.15`, and `4.2.27` to fix **CVE-2025-64460**, a denial-of-service vulnerability in the framework's XML deserialization logic. The flaw is rooted in `django.core.serializers.xml_serializer.getInnerText()`, where specially crafted XML can trigger excessive CPU and memory consumption, allowing a remote attacker to exhaust resources and disrupt affected applications. The issue was reported by Seokchan Yoon and affects supported Django branches before those patched versions; unsupported branches including `5.0.x`, `4.1.x`, and `3.2.x` were not evaluated and may also be exposed. Red Hat classified the bug as **Important** with a CVSS v3.1 score of `7.5` and said no acceptable mitigation was available at publication, making patching the primary response. The company warned that products using Django's XML Deserializer may be affected, including **Red Hat Ansible Automation Platform**, **Red Hat OpenStack Platform**, and **OpenShift Service Mesh**, and published fixes for multiple Ansible Automation Platform releases through advisories `RHSA-2026:1249`, `RHSA-2026:1497`, and `RHSA-2026:1506`.
Aug 20, 2026
A high-severity SQL injection vulnerability tracked as **`CVE-2025-64459`** was disclosed in the Django web framework, affecting **`QuerySet.filter()`**, **`QuerySet.exclude()`**, **`QuerySet.get()`**, and the **`Q()`** class when a suitably crafted dictionary is expanded into the **`_connector`** argument. The issue received a **CVSS 9.1** score in the CVE record, while Red Hat rated it **Important** with a **CVSS v3 8.3**, citing vendor-specific scoring differences and noting that exploitation impact is limited to the effective user scope of the running process. Red Hat reported that no acceptable mitigation is currently available and identified multiple affected products and components, including packages in **Red Hat Ansible Automation Platform 2.5 for RHEL 8**. The company said fixes were released for impacted offerings, including remediation delivered through advisory **`RHSA-2025:23069`**, underscoring the need for organizations running Django-based applications or affected Red Hat packages to prioritize patching.
Aug 20, 2026
Django maintainers released urgent security updates addressing **six vulnerabilities** affecting multiple supported branches, including **three high-severity SQL injection flaws** and multiple **denial-of-service (DoS)** vectors. The issues impact Django **4.2**, **5.2**, **6.0**, and the main development branch, with fixed releases called out as **Django 4.2.28**, **5.2.11**, and **6.0.2**. The most severe fixes cover SQL injection paths that can allow execution of arbitrary SQL: **CVE-2026-1207** affects **PostGIS** users via raster lookups on GIS fields when untrusted input is used as a band index; **CVE-2026-1287** involves `FilteredRelation` SQL injection through column aliases containing control characters when crafted dictionaries are expanded into `QuerySet` methods (e.g., `annotate()`, `aggregate()`, `values()`); and **CVE-2026-1312** targets `QuerySet.order_by()` with `FilteredRelation` via column aliases containing periods. DoS fixes include **CVE-2025-14550** (resource exhaustion via repeated/duplicate headers in **ASGI** deployments) and **CVE-2026-1285** (DoS in `django.utils.text.Truncator` HTML methods), alongside a low-severity timing issue **CVE-2025-13473** that can enable username enumeration in a `mod_wsgi` authentication handler.
Jun 29, 2026