Loading vulnerability…
CVE-2025-64460 is a denial-of-service vulnerability in Django’s XML serialization/deserialization functionality. The issue is in django.core.serializers.xml_serializer.getInnerText(), where algorithmically inefficient processing of XML text content can be triggered by specially crafted XML input handled by the XML Deserializer. Available reporting indicates the flaw stems from inefficient recursive text-node collection and repeated string concatenation, resulting in superlinear, potentially O(n²), resource consumption. A remote attacker can supply malicious XML that causes excessive CPU and memory usage during deserialization. Affected supported versions are Django 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Earlier unsupported series, including 5.0.x, 4.1.x, and 3.2.x, were not evaluated and may also be affected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Deserializer, leading to degraded application performance, request handling delays, worker exhaustion, or full service outage. The issue is an availability impact rather than a confidentiality or integrity compromise based on the provided information.If you can’t patch tonight, do this now.
Deserializer, disabling or avoiding XML deserialization where not required, enforcing strict request size and parsing limits, and applying upstream-facing controls such as rate limiting, request filtering, and monitoring for anomalous XML payloads or resource spikes. These are compensating controls only; upgrading is the primary fix.Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in Django. Details not specified in the content.
Moderate-severity denial-of-service in Django XML serialization/deserialization due to algorithmic complexity (O(n^2)) in getInnerText() from inefficient recursive string concatenation, allowing crafted XML to cause high CPU/memory usage and outages.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.