Django security releases issued: 5.2.8, 5.1.14, and 4.2.26
In accordance with our security release policy, the Django team is issuing releases for Django 5.2.8, Django 5.1.14, and Django 4.2.26. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible.
CVE-2025-64458: Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
NFKC normalization in Python is slow on Windows. As a consequence, HttpResponseRedirect, HttpResponsePermanentRedirect, and redirect were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report.
This issue has severity "moderate" according to the Django security policy.
CVE-2025-64459: Potential SQL injection via _connector keyword argument in QuerySet and Q objects
The methods QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the class Q() were subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
Thanks to cyberstan for the report.
This issue has severity "high" according to the Django security policy.
Affected supported versions
- Django main
- Django 6.0 (currently at beta status)
- Django 5.2
- Django 5.1
- Django 4.2
Resolution
Patches to resolve the issue have been applied to Django's main, 6.0 (currently at beta status), 5.2, 5.1, and 4.2 branches. The patches may be obtained from the following changesets.
CVE-2025-64458: Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
- On the main branch
- On the 6.0 branch
- On the 5.2 branch
- On the 5.1 branch
- On the 4.2 branch
CVE-2025-64459: Potential SQL injection via _connector keyword argument in QuerySet and Q objects
- On the main branch
- On the 6.0 branch
- On the 5.2 branch
- On the 5.1 branch
- On the 4.2 branch
The following releases have been issued
- Django 5.2.8 (download Django 5.2.8 | 5.2.8 checksums)
- Django 5.1.14 (download Django 5.1.14 | 5.1.14 checksums)
- Django 4.2.26 (download Django 4.2.26 | 4.2.26 checksums)
The PGP key ID used for this release is Natalia Bidart: 2EE82A8D9470983E
General notes regarding security reporting
As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance, nor via the Django Forum. Please see our security policies for further information.
