Django, one of the most popular Python web application development frameworks, has revealed two critical security vulnerabilities that could allow attackers to perform SQL injection attacks and launch denial of service (DoS) attacks.
See also: Exploiting SQL Injection vulnerability in FreePBX
The vulnerabilities, identified as CVE-2025-64458 and CVE-2025-64459 , affect key components of the framework and require immediate attention from developers using Django in their applications. The more serious of the two vulnerabilities, CVE-2025-64459, carries a high severity rating and involves a potential SQL injection vulnerability in Django's QuerySet and Q objects
Security researcher Cyberstan discovered that the QuerySet.filter(), QuerySet.exclude(), and QuerySet.get() methods , along with the Q() class , are vulnerable when processing specially crafted dictionaries that use _connector as a keyword argument with dictionary expansion. This flaw could allow malicious users to inject arbitrary SQL commands into database queries, potentially compromising sensitive data or gaining unauthorized access to backend systems.
See also: Malicious users take over MS-SQL Server and deploy XiebroC2
SQL injection remains one of the most dangerous web application vulnerabilities, making this discovery particularly concerning for organizations that rely on Django for their infrastructure. The second vulnerability, CVE-2025-64458, affects Django installations running on Windows. Seokchan Yoon of ch4n3.KR discovered this moderate severity denial of service vulnerability in the HttpResponseRedirect and HttpResponsePermanentRedirect. The issue arises from slow NFKC normalization in Python on Windows.
Attackers can exploit this performance by submitting inputs containing a large number of Unicode characters, causing the application to consume excessive resources and possibly become unresponsive. Although rated as moderate severity, this vulnerability could still disrupt services and impact the user experience on Windows-based Django installations.
See also: Web Application Security: SQL Injection, XSS, CSRF and WAF
Django developers should update their installations to the latest versions with fixes as soon as possible. Organizations using Django on Windows systems should pay special attention to the DoS vulnerability. At the same time, all Django users should address the SQL injection vulnerability regardless of their operating system. Regular security updates and adherence to Django security best practices remain essential to maintaining secure web applications.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
