Loading story…
A disclosed vulnerability in the Django web framework, tracked as CVE-2025-57833, allows SQL injection through FilteredRelation column aliases when a suitably crafted dictionary is expanded as **kwargs into QuerySet.annotate() or QuerySet.alias(). The issue is classified as CWE-89 and affects applications that pass attacker-controlled input into those ORM methods, potentially enabling unauthorized database query manipulation.
Red Hat rated the flaw Important with a CVSS v3 score of 7.1, while noting that the NVD assigned a higher 8.1 score. Red Hat also said there was no acceptable mitigation at disclosure and identified multiple affected products and components, which were later addressed through security errata released in September and October 2025.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2025:16403 and RHSA-2025:16404 to fix CVE-2025-57833 in Red Hat Ansible Automation Platform 2.4 for RHEL 8 and RHEL 9, including python3x-django, python-django, and lightspeed-related components.
Red Hat made its CVE-2025-57833 entry public, describing an SQL injection vulnerability in Django involving FilteredRelation column aliases. The flaw can be triggered via a crafted dictionary expanded as **kwargs to QuerySet.annotate() or QuerySet.alias().
Red Hat last modified its CVE-2025-57833 entry, reflecting an update to the vendor advisory record for the Django SQL injection issue.
Red Hat published RHSA-2025:17499 and RHSA-2025:17498 to remediate CVE-2025-57833 in Red Hat OpenStack Platform 16.2 and 17.1, affecting python-django20 and python-django packages.
Red Hat released RHSA-2025:16487 and RHSA-2025:16514 to address CVE-2025-57833 in Red Hat Ansible Automation Platform 2.5 for RHEL 8 and RHEL 9, covering automation-controller, python3.11-django, and lightspeed-related packages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity SQL injection vulnerability tracked as **`CVE-2025-64459`** was disclosed in the Django web framework, affecting **`QuerySet.filter()`**, **`QuerySet.exclude()`**, **`QuerySet.get()`**, and the **`Q()`** class when a suitably crafted dictionary is expanded into the **`_connector`** argument. The issue received a **CVSS 9.1** score in the CVE record, while Red Hat rated it **Important** with a **CVSS v3 8.3**, citing vendor-specific scoring differences and noting that exploitation impact is limited to the effective user scope of the running process. Red Hat reported that no acceptable mitigation is currently available and identified multiple affected products and components, including packages in **Red Hat Ansible Automation Platform 2.5 for RHEL 8**. The company said fixes were released for impacted offerings, including remediation delivered through advisory **`RHSA-2025:23069`**, underscoring the need for organizations running Django-based applications or affected Red Hat packages to prioritize patching.
Aug 20, 2026
Django maintainers released urgent security updates addressing **six vulnerabilities** affecting multiple supported branches, including **three high-severity SQL injection flaws** and multiple **denial-of-service (DoS)** vectors. The issues impact Django **4.2**, **5.2**, **6.0**, and the main development branch, with fixed releases called out as **Django 4.2.28**, **5.2.11**, and **6.0.2**. The most severe fixes cover SQL injection paths that can allow execution of arbitrary SQL: **CVE-2026-1207** affects **PostGIS** users via raster lookups on GIS fields when untrusted input is used as a band index; **CVE-2026-1287** involves `FilteredRelation` SQL injection through column aliases containing control characters when crafted dictionaries are expanded into `QuerySet` methods (e.g., `annotate()`, `aggregate()`, `values()`); and **CVE-2026-1312** targets `QuerySet.order_by()` with `FilteredRelation` via column aliases containing periods. DoS fixes include **CVE-2025-14550** (resource exhaustion via repeated/duplicate headers in **ASGI** deployments) and **CVE-2026-1285** (DoS in `django.utils.text.Truncator` HTML methods), alongside a low-severity timing issue **CVE-2025-13473** that can enable username enumeration in a `mod_wsgi` authentication handler.
Jun 29, 2026
The Django development team released a security update addressing two critical vulnerabilities: a high-severity SQL injection flaw (CVE-2025-64459) and a denial-of-service (DoS) bug (CVE-2025-64458). The SQL injection vulnerability, present in Django's Object-Relational Mapper (ORM), could allow attackers to manipulate database queries and compromise data integrity if exploited. The DoS vulnerability could enable attackers to disrupt application availability by sending specially crafted requests. Security researchers highlighted that these flaws expose underlying risks in Django's ORM, which is widely trusted for its built-in security features. The incident underscores the importance of regular security reviews and prompt patching, even for mature frameworks. Organizations using Django are strongly advised to apply the latest security updates to mitigate these threats and reassess their reliance on default ORM protections.
Jun 29, 2026