Django Flaws Enable SQL Injection and DoS Attacks

New Django flaws expose sites to SQL injection and DoS attacks, underscoring the need for stronger security practices.

The Django Software Foundation has released critical security updates addressing two vulnerabilities that could allow remote attackers to execute SQL injection and denial-of-service (DoS) attacks on affected systems.

Django, one of the most widely used Python web frameworks, powers millions of web applications globally, including enterprise platforms, APIs, and content management systems.

The vulnerabilities impact multiple Django versions, including 4.2, 5.1, 5.2, and the 6.0 beta.

The SQL injection vulnerability ( CVE-2025-64459 ) could allow attackers to inject arbitrary SQL commands into backend database queries.

The flaw was identified in Django’s QuerySet methods filter() , exclude() , and get() and the Q() class.

The issue arises when these components process specially crafted Python dictionaries using the _connector keyword argument with dictionary expansion.

This could enable unauthorized data access, data modification, or even complete database compromise.

The second flaw, CVE-2025-64458 , involves a Windows-specific denial-of-service weakness rated at a moderate severity level.

It targets the framework’s HttpResponseRedirect and HttpResponsePermanentRedirect functions, both of which are vulnerable due to slow NFKC normalization in Python on Windows.

An attacker can exploit this weakness by sending inputs containing extremely large numbers of Unicode characters, causing excessive CPU usage and memory consumption.

The resulting slowdown can lead to a denial-of-service condition, temporarily preventing legitimate users from accessing the application.

This vulnerability can be used to disrupt web services, especially for organizations deploying Django applications on Windows servers.

These vulnerabilities underscore the importance of defense-in-depth strategies for all organizations running web applications, regardless of the underlying framework.

While patching is essential, organizations should implement additional safeguards to strengthen their overall security posture and minimize the likelihood of similar exploits being successful.

Additional mitigations besides patching include:

The disclosure of CVE-2025-64459 and CVE-2025-64458 reinforces the ongoing relevance of traditional web vulnerabilities in modern frameworks.

The Django incident underscores that security is an ongoing discipline—effective protection depends on consistent maintenance, timely updates, and continuous monitoring of critical web systems.

As organizations strive to keep pace with evolving threats, leveraging DevSecOps tools has become essential to embed security seamlessly throughout the development lifecycle.

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University and brings years of hands-on experience to the field.

Check Point shows how generative AI accelerates XLoader analysis, uncovering real C2s and enabling faster, smarter malware defense.

A critical React Native flaw exposes millions of developers to remote code attacks.

The NGate malware uses Android NFC relays and social engineering to let attackers withdraw cash from ATMs without stealing victims’ cards.

European authorities dismantled a €600 million crypto fraud network in a coordinated international operation.