Multiple Django Vulnerabilities Enable SQL Injection and Denial-of-Service Attacks

The Django development team has released urgent security patches addressing two significant vulnerabilities affecting popular Python web framework versions.

The critical updates target Django 5.2.9, 5.1.15, 4.2.27, alongside the upcoming Django 6.0 release candidate and main development branch, protecting applications from SQL injection attacks and denial-of-service conditions.

CVE ID	Vulnerability Type	Affected Component	Severity
CVE-2025-13372	SQL Injection	FilteredRelation (PostgreSQL)	High
CVE-2025-64460	Denial-of-Service	XML Serializer	Moderate

High-Severity SQL Injection in FilteredRelation

Security researcher Stackered identified a critical SQL injection vulnerability tracked as CVE-2025-13372 within Django’s FilteredRelation feature for PostgreSQL databases.

The flaw allows attackers to execute arbitrary SQL commands through specially crafted dictionaries passed as keyword arguments to QuerySet.annotate() or QuerySet.alias() methods.

The exploitation technique leverages dictionary expansion to manipulate column aliases in FilteredRelation queries.

By injecting malicious SQL code, attackers gain unauthorized access to modify or delete database records.

This vulnerability poses severe risks to production Django applications relying on PostgreSQL, potentially exposing sensitive user data and critical business information.

The technical mechanism involves bypassing query parameter sanitization through improper handling of keyword argument expansion in the ORM layer.

Security teams recommend immediate patching as this represents a direct pathway to data compromise.

Researcher Seokchan Yoon discovered a denial-of-service vulnerability identified as CVE-2025-64460 within Django’s XML serialization functionality.

The flaw exists in the django.core.serializers.xml_serializer.getInnerText() function, where an algorithmic complexity issue allows attackers to trigger excessive resource consumption.

The vulnerability stems from inefficient string concatenation during recursive text node collection, creating superlinear computational complexity.

When attackers submit specially crafted XML input to services utilizing the XML Deserializer, the function enters a resource-intensive processing loop consuming substantial CPU and memory. This condition can significantly degrade application performance or trigger complete service outages.

The technical root cause involves repeated string concatenation operations (O(n²) complexity) rather than optimized string-building methods, making the function vulnerable to specially crafted XML payloads containing deeply nested or extensively repeated text nodes.

The Django security team released patches through multiple channels on December 2, 2025. Updated versions for Django 4.2, 5.1, 5.2, and the 6.0 release candidate are available on the official Django website and GitHub repositories.

All patches carry cryptographic signatures from PGP key ID 2EE82A8D9470983E belonging to Natalia Bidart, ensuring authenticity and integrity.

Organizations running affected Django versions should prioritize updating immediately. The patches maintain backward compatibility while closing security loopholes without requiring application code modifications beyond the version upgrade.

Both vulnerabilities affect all currently supported Django versions, creating widespread exposure across the Python web development ecosystem.

The SQL injection vulnerability presents the most critical risk, enabling direct database compromise. The denial-of-service issue threatens application availability and resource efficiency.

Administrators managing Django deployments should review their version status and implement security updates within their maintenance windows.

Security teams recommend conducting post-patch vulnerability scans to confirm successful remediation across infrastructure.

Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates