Django Team Patches High-Severity SQL Injection Flaw (CVE-2025-64459) and DoS Bug (CVE-2025-64458) in Latest Security Update

Django has released security updates addressing two vulnerabilities, CVE-2025-64459, a high-severity SQL injection flaw, and CVE-2025-64458, a moderate Denial-of-Service issue, with patches available in Django 5.2.8, 5.1.14, and 4.2.26, as well as for the main branch and the 6.0 beta.

The CVE-2025-64459 flaw affects several common database methods, including QuerySet[.]filter(), QuerySet[.]exclude(), QuerySet[.]get(), and the Q() class, and could allow remote attackers to modify, leak, or destroy database content if dictionary expansion via the _connector argument is exploited. CVE-2025-64458 concerns Unicode normalization performance on Windows, potentially allowing a DoS via HTTP redirects through inputs with very large numbers of Unicode characters.

The Django Software Foundation disclosed the issues, and the update urges users to upgrade immediately to mitigate risks. Affected versions include the Django main branch, 6.0 beta, and Django 5.2, 5.1, and 4.2.