Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
Published Nov 5, 2025
7.5
HIGHCVSS 3.1
EPSS 1.90%
Description
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
Affected products
-
- Version 4.2StatusaffectedConstraints<4.2.26
- Version 5.1StatusaffectedConstraints<5.1.14
- Version 5.2StatusaffectedConstraints<5.2.8
- Version 4.2.26StatusunaffectedConstraints-
- Version 5.1.14StatusunaffectedConstraints-
- Version 5.2.8StatusunaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Djangoproject | Django | unaffected |
|
- ≥ 4.2 · < 4.2.26
- ≥ 5.1 · < 5.1.14
- ≥ 5.2 · < 5.2.8
No data.
OpenShift Service Mesh 2
openshift-service-mesh/grafana-rhel8
Not affected
OpenShift Service Mesh 2
openshift-service-mesh/istio-cni-rhel8
Not affected
OpenShift Service Mesh 2
openshift-service-mesh/istio-must-gather-rhel9
Not affected
OpenShift Service Mesh 2
openshift-service-mesh/istio-operator-bundle
Not affected
OpenShift Service Mesh 2
openshift-service-mesh/istio-rhel8-operator
Not affected
OpenShift Service Mesh 2
openshift-service-mesh/pilot-rhel8
Not affected
OpenShift Service Mesh 2
openshift-service-mesh/proxyv2-rhel9
Not affected
OpenShift Service Mesh 2
openshift-service-mesh/ratelimit-rhel8
Not affected
OpenShift Service Mesh 3
openshift-service-mesh-tech-preview/istio-ztunnel-rhel9
Not affected
OpenShift Service Mesh 3
openshift-service-mesh/istio-cni-rhel9
Not affected
OpenShift Service Mesh 3
openshift-service-mesh/istio-must-gather-rhel9
Not affected
OpenShift Service Mesh 3
openshift-service-mesh/istio-pilot-rhel9
Not affected
OpenShift Service Mesh 3
openshift-service-mesh/istio-proxyv2-rhel9
Not affected
OpenShift Service Mesh 3
openshift-service-mesh/istio-rhel9-operator
Not affected
OpenShift Service Mesh 3
openshift-service-mesh/istio-sail-operator-bundle
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-24/de-minimal-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-24/de-minimal-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-24/de-supported-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-24/de-supported-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-24/ee-dellemc-openmanage-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-24/ee-minimal-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-24/ee-minimal-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-24/ee-supported-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-24/ee-supported-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-24/lightspeed-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-24/platform-resource-runner-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/aap-cloud-metrics-collector-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/ansible-dev-tools-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/de-minimal-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/de-minimal-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/de-supported-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/de-supported-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/ee-cloud-services-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/ee-minimal-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/ee-minimal-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/ee-supported-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/ee-supported-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/lightspeed-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/platform-resource-runner-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/ansible-dev-tools-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/controller-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/de-minimal-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/de-supported-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/eda-controller-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/ee-minimal-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/ee-supported-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/gateway-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/hub-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/lightspeed-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/mcp-tools-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/platform-resource-runner-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-tech-preview/ansible-devspaces-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-tech-preview/automation-dashboard-rhel9
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform/ee-minimal-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform/ee-minimal-rhel9
Not affected
Red Hat Ansible Automation Platform 2
automation-controller
Not affected
Red Hat Discovery 1
discovery/discovery-server-rhel9
Not affected
Red Hat Discovery 2
discovery/discovery-server-rhel9
Not affected
Red Hat OpenStack Platform 13 (Queens)
rhosp13/openstack-horizon
Not affected
Red Hat OpenStack Platform 13 (Queens)
rhosp13/openstack-horizon-base
Not affected
Red Hat OpenStack Platform 16.2
rhosp-rhel8/openstack-horizon
Not affected
Red Hat OpenStack Platform 17.1
rhosp-rhel9/openstack-horizon
Not affected
Red Hat OpenStack Platform 18.0
rhoso/openstack-horizon-rhel9
Not affected
Red Hat Satellite 6
satellite/iop-advisor-backend-rhel9
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| OpenShift Service Mesh 2 | openshift-service-mesh/grafana-rhel8 | Not affected | n/a |
| OpenShift Service Mesh 2 | openshift-service-mesh/istio-cni-rhel8 | Not affected | n/a |
| OpenShift Service Mesh 2 | openshift-service-mesh/istio-must-gather-rhel9 | Not affected | n/a |
| OpenShift Service Mesh 2 | openshift-service-mesh/istio-operator-bundle | Not affected | n/a |
| OpenShift Service Mesh 2 | openshift-service-mesh/istio-rhel8-operator | Not affected | n/a |
| OpenShift Service Mesh 2 | openshift-service-mesh/pilot-rhel8 | Not affected | n/a |
| OpenShift Service Mesh 2 | openshift-service-mesh/proxyv2-rhel9 | Not affected | n/a |
| OpenShift Service Mesh 2 | openshift-service-mesh/ratelimit-rhel8 | Not affected | n/a |
| OpenShift Service Mesh 3 | openshift-service-mesh-tech-preview/istio-ztunnel-rhel9 | Not affected | n/a |
| OpenShift Service Mesh 3 | openshift-service-mesh/istio-cni-rhel9 | Not affected | n/a |
| OpenShift Service Mesh 3 | openshift-service-mesh/istio-must-gather-rhel9 | Not affected | n/a |
| OpenShift Service Mesh 3 | openshift-service-mesh/istio-pilot-rhel9 | Not affected | n/a |
| OpenShift Service Mesh 3 | openshift-service-mesh/istio-proxyv2-rhel9 | Not affected | n/a |
| OpenShift Service Mesh 3 | openshift-service-mesh/istio-rhel9-operator | Not affected | n/a |
| OpenShift Service Mesh 3 | openshift-service-mesh/istio-sail-operator-bundle | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/de-minimal-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/de-minimal-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/de-supported-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/de-supported-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/ee-dellemc-openmanage-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/ee-minimal-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/ee-minimal-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/ee-supported-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/ee-supported-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/lightspeed-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/platform-resource-runner-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/aap-cloud-metrics-collector-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/ansible-dev-tools-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/de-minimal-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/de-minimal-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/de-supported-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/de-supported-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/ee-cloud-services-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/ee-minimal-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/ee-minimal-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/ee-supported-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/ee-supported-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/lightspeed-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/platform-resource-runner-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/ansible-dev-tools-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/controller-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/de-minimal-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/de-supported-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/eda-controller-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/ee-minimal-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/ee-supported-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/gateway-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/hub-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/lightspeed-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/mcp-tools-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/platform-resource-runner-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-tech-preview/ansible-devspaces-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-tech-preview/automation-dashboard-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform/ee-minimal-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform/ee-minimal-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | automation-controller | Not affected | n/a |
| Red Hat Discovery 1 | discovery/discovery-server-rhel9 | Not affected | n/a |
| Red Hat Discovery 2 | discovery/discovery-server-rhel9 | Not affected | n/a |
| Red Hat OpenStack Platform 13 (Queens) | rhosp13/openstack-horizon | Not affected | n/a |
| Red Hat OpenStack Platform 13 (Queens) | rhosp13/openstack-horizon-base | Not affected | n/a |
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8/openstack-horizon | Not affected | n/a |
| Red Hat OpenStack Platform 17.1 | rhosp-rhel9/openstack-horizon | Not affected | n/a |
| Red Hat OpenStack Platform 18.0 | rhoso/openstack-horizon-rhel9 | Not affected | n/a |
| Red Hat Satellite 6 | satellite/iop-advisor-backend-rhel9 | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
YesTechnical Impact
PartialDecision
n/aAssessed Nov 5, 2025 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2025–2026- EPSS v4
- EPSS v5
Percentile over time
- EPSS v4
- EPSS v5
Table of values (3 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 1.90% (0.01902) | 78.96th | v5 (v2026.06.15) |
| Jun 15, 2026 | 1.86% (0.01862) | 76.44th | v5 (v2026.06.15) |
| Nov 6, 2025 | 0.01% (0.00014) | 1.84th | v4 (v2025.03.14) |
References (13)
- https://access.redhat.com/security/cve/CVE-2025-64458 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2412649 Issue Tracking
- https://docs.djangoproject.com/en/dev/releases/security vendor-advisoryVendor Advisory
- https://github.com/advisories/GHSA-qw25-v68c-qjf3 Advisory
- https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
- https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac
- https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f
- https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-107.yaml
- https://groups.google.com/g/django-announce mailing-listMailing List
- https://nvd.nist.gov/vuln/detail/CVE-2025-64458
- https://www.cve.org/CVERecord?id=CVE-2025-64458
- https://www.djangoproject.com/weblog/2025/nov/05/security-releases vendor-advisoryVendor Advisory
Change history (0)
No recorded changes yet.