CVE-2025-64458
HIGHDjango 4.2-4.2.25, 5.1-5.1.13, 5.2-5.2.7 - Denial of Service via NFKC Unicode Normalization
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-64458. PoCs published by ch4n3-yoon.
AI-analyzed exploit summary This repository contains a functional PoC demonstrating CVE-2025-64458, a DoS vulnerability in Django's redirect responses on Windows due to slow Unicode NFKC normalization. The PoC measures the performance impact of constructing redirect responses with excessively long Unicode URLs.
Description
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
Exploits (1)
This repository contains a functional PoC demonstrating CVE-2025-64458, a DoS vulnerability in Django's redirect responses on Windows due to slow Unicode NFKC normalization. The PoC measures the performance impact of constructing redirect responses with excessively long Unicode URLs.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H