Skip to content
OpenAdvisories
Critical DLA-4425-1 2 CVEs

python-django - security update

Published Dec 29, 2025 · Updated Dec 29, 2025

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 python-django 2:2.2.28-1~deb11u10

Vulnerabilities 2

  • Critical 9.1
    CVE-2025-64459 Public exploit EPSS 19%

    Potential SQL injection via _connector keyword argument in QuerySet and Q objects

    An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, wit…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2025-64460

    Potential denial-of-service vulnerability in XML serializer text extraction

    An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and …

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI