https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:25:38 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-01121 bdu:2026-01121 https://cve.radiocsirt.org/vuln/bdu:2026-01121 https://cve.radiocsirt.org/vuln/bit-django-2025-64460 <p><strong>Affected:</strong> Bitnami: django</p> <p>An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> <p><strong>Affected:</strong> Bitnami: django</p> <p>An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> https://cve.radiocsirt.org/vuln/bit-django-2025-64460 https://cve.radiocsirt.org/vuln/euvd-2026-262373 EUVD-2026-262373 https://cve.radiocsirt.org/vuln/euvd-2026-262373 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64460 <p>An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> <p>An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-64460 https://cve.radiocsirt.org/vuln/ghsa-vrcr-9hj9-jcg6 <p><strong>Affected:</strong> PyPI: Django</p> <p>An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> <p><strong>Affected:</strong> PyPI: Django</p> <p>An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> https://cve.radiocsirt.org/vuln/ghsa-vrcr-9hj9-jcg6 https://cve.radiocsirt.org/vuln/oesa-2025-2788 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP2: python-django</p> <p>A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fix(es):</p> <p>An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.(CVE-2025-64460)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP2: python-django</p> <p>A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fix(es):</p> <p>An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.(CVE-2025-64460)</p> https://cve.radiocsirt.org/vuln/oesa-2025-2788 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15805-1 <p>python311-Django-5.2.9-1.1 on GA media</p> <p>python311-Django-5.2.9-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15805-1 https://cve.radiocsirt.org/vuln/pysec-2025-109 <p><strong>Affected:</strong> PyPI: django</p> <p>An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> <p><strong>Affected:</strong> PyPI: django</p> <p>An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> https://cve.radiocsirt.org/vuln/pysec-2025-109 https://cve.radiocsirt.org/vuln/rhsa-2026:0414 <p>python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump cpython: Python HTMLParser quadratic complexity python: Quadratic complexity in os.path.expandvars() with user-controlled template cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications qs: qs: Denial of Service via improper input validation in array parsing tar: Tar path traversal firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing django: Potential partial directory-traversal via archive.extract() openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand openssh: OpenSSH: Null character in ssh:// URI can lead to code execution via ProxyCommand Django: Django: Algorithmic complexity in XML Deserializer leads to denial of service libpng: LIBPNG buffer overflow glob: glob: Command Injection Vulnerability via Malicious Filenames libpng: LIBPNG heap buffer overflow node-forge: node-forge ASN.1 Unbounded Recursion libpng: LIBPNG out-of-bounds read in png_image_read_composite urllib3: urlli…</p> <p>python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump cpython: Python HTMLParser quadratic complexity python: Quadratic complexity in os.path.expandvars() with user-controlled template cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications qs: qs: Denial of Service via improper input validation in array parsing tar: Tar path traversal firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing django: Potential partial directory-traversal via archive.extract() openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand openssh: OpenSSH: Null character in ssh:// URI can lead to code execution via ProxyCommand Django: Django: Algorithmic complexity in XML Deserializer leads to denial of service libpng: LIBPNG buffer overflow glob: glob: Command Injection Vulnerability via Malicious Filenames libpng: LIBPNG heap buffer overflow node-forge: node-forge ASN.1 Unbounded Recursion libpng: LIBPNG out-of-bounds read in png_image_read_composite urllib3: urlli…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:0414 https://cve.radiocsirt.org/vuln/suse-su-2025:4384-1 <p>Security update for python-Django</p> <p>Security update for python-Django</p> https://cve.radiocsirt.org/vuln/suse-su-2025:4384-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-64460 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-django, Ubuntu:Pro:16.04:LTS: python-django, Ubuntu:Pro:18.04:LTS: python-django, Ubuntu:Pro:20.04:LTS: python-django, Ubuntu:22.04:LTS: python-django, Ubuntu:24.04:LTS: python-django, Ubuntu:25.10: python-django, Ubuntu:26.04:LTS: python-django</p> <p>An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-django, Ubuntu:Pro:16.04:LTS: python-django, Ubuntu:Pro:18.04:LTS: python-django, Ubuntu:Pro:20.04:LTS: python-django, Ubuntu:22.04:LTS: python-django, Ubuntu:24.04:LTS: python-django, Ubuntu:25.10: python-django, Ubuntu:26.04:LTS: python-django</p> <p>An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-64460 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2717 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Django ausnutzen, um Informationen offenzulegen oder einen Denial of Service herbeizuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Django ausnutzen, um Informationen offenzulegen oder einen Denial of Service herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2717