Multiple Django Flaws Could Allow SQL Injection and Denial-of-Service Attacks

The Django development team released patches on 5 November 2025 for two significant vulnerabilities that could impact Django applications, including high-risk SQL injection in QuerySet operations and a moderate DoS flaw on Windows. According to Django’s standard security release policy, patches for Django 5.2.8, 5.1.14 and 4.2.26 were issued, and organisations running Django 4.2, 5.1 or 5.2 should update immediately.

The SQL injection flaw, CVE-2025-64459, affects several QuerySet methods (filter, exclude and get) and the Q() class when a crafted dictionary using the _connector argument is processed, potentially allowing attackers to inject arbitrary SQL commands. The DoS vulnerability, CVE-2025-64458, concerns HttpResponseRedirect and HttpResponsePermanentRedirect on Windows due to inefficient NFKC Unicode normalization, which could be exploited by sending large Unicode inputs to exhaust resources. Affected versions include Django 4.2, 5.1, 5.2 and 6.0 (beta), and patches have been applied across the development main branch and the 6.0 beta.