Loading story…
A high-severity SQL injection vulnerability tracked as CVE-2025-64459 was disclosed in the Django web framework, affecting QuerySet.filter(), QuerySet.exclude(), QuerySet.get(), and the Q() class when a suitably crafted dictionary is expanded into the _connector argument. The issue received a CVSS 9.1 score in the CVE record, while Red Hat rated it Important with a CVSS v3 8.3, citing vendor-specific scoring differences and noting that exploitation impact is limited to the effective user scope of the running process.
Red Hat reported that no acceptable mitigation is currently available and identified multiple affected products and components, including packages in Red Hat Ansible Automation Platform 2.5 for RHEL 8. The company said fixes were released for impacted offerings, including remediation delivered through advisory RHSA-2025:23069, underscoring the need for organizations running Django-based applications or affected Red Hat packages to prioritize patching.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
On December 10, 2025, Red Hat issued RHSA-2025:23069 to fix CVE-2025-64459 in multiple Red Hat Ansible Automation Platform 2.5 for RHEL 8 components, including ansible-builder, ansible-runner, ansible-navigator, and automation-controller.
Red Hat marked its CVE-2025-64459 entry public on November 5, 2025, describing the Django flaw as an Important SQL injection issue and noting no acceptable mitigation was available at that time.
Django security release information dated November 5, 2025 identified CVE-2025-64459 as a SQL injection vulnerability affecting QuerySet.filter(), QuerySet.exclude(), QuerySet.get(), and the Q() class when a crafted dictionary is expanded into the _connector argument.
Red Hat last modified its CVE-2025-64459 entry on March 18, 2026, reflecting an update to the vendor's vulnerability record for the Django SQL injection issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A disclosed vulnerability in the Django web framework, tracked as **`CVE-2025-57833`**, allows **SQL injection** through `FilteredRelation` column aliases when a suitably crafted dictionary is expanded as `**kwargs` into `QuerySet.annotate()` or `QuerySet.alias()`. The issue is classified as **`CWE-89`** and affects applications that pass attacker-controlled input into those ORM methods, potentially enabling unauthorized database query manipulation. Red Hat rated the flaw **Important** with a **CVSS v3 score of 7.1**, while noting that the NVD assigned a higher **8.1** score. Red Hat also said there was **no acceptable mitigation** at disclosure and identified multiple affected products and components, which were later addressed through security errata released in September and October 2025.
Aug 20, 2026
Django issued security releases `5.2.9`, `5.1.15`, and `4.2.27` to fix **CVE-2025-64460**, a denial-of-service vulnerability in the framework's XML deserialization logic. The flaw is rooted in `django.core.serializers.xml_serializer.getInnerText()`, where specially crafted XML can trigger excessive CPU and memory consumption, allowing a remote attacker to exhaust resources and disrupt affected applications. The issue was reported by Seokchan Yoon and affects supported Django branches before those patched versions; unsupported branches including `5.0.x`, `4.1.x`, and `3.2.x` were not evaluated and may also be exposed. Red Hat classified the bug as **Important** with a CVSS v3.1 score of `7.5` and said no acceptable mitigation was available at publication, making patching the primary response. The company warned that products using Django's XML Deserializer may be affected, including **Red Hat Ansible Automation Platform**, **Red Hat OpenStack Platform**, and **OpenShift Service Mesh**, and published fixes for multiple Ansible Automation Platform releases through advisories `RHSA-2026:1249`, `RHSA-2026:1497`, and `RHSA-2026:1506`.
Aug 20, 2026
Django maintainers released urgent security updates addressing **six vulnerabilities** affecting multiple supported branches, including **three high-severity SQL injection flaws** and multiple **denial-of-service (DoS)** vectors. The issues impact Django **4.2**, **5.2**, **6.0**, and the main development branch, with fixed releases called out as **Django 4.2.28**, **5.2.11**, and **6.0.2**. The most severe fixes cover SQL injection paths that can allow execution of arbitrary SQL: **CVE-2026-1207** affects **PostGIS** users via raster lookups on GIS fields when untrusted input is used as a band index; **CVE-2026-1287** involves `FilteredRelation` SQL injection through column aliases containing control characters when crafted dictionaries are expanded into `QuerySet` methods (e.g., `annotate()`, `aggregate()`, `values()`); and **CVE-2026-1312** targets `QuerySet.order_by()` with `FilteredRelation` via column aliases containing periods. DoS fixes include **CVE-2025-14550** (resource exhaustion via repeated/duplicate headers in **ASGI** deployments) and **CVE-2026-1285** (DoS in `django.utils.text.Truncator` HTML methods), alongside a low-severity timing issue **CVE-2025-13473** that can enable username enumeration in a `mod_wsgi` authentication handler.
Jun 29, 2026