Django CVE-2025-64458 and CVE-2025-64459

[Natalia Bidart <nataliabidart () djangoproject com>]

* Announce:
https://www.djangoproject.com/weblog/2025/nov/05/security-releases/

* JSON Record for CVE-2025-64458:
https://www.cve.org/CVERecord?id=CVE-2025-64458

* JSON Record for CVE-2025-64459:
https://www.cve.org/CVERecord?id=CVE-2025-64459

In accordance with `our security release policy
<https://docs.djangoproject.com/en/dev/internals/security/>`_, the Django
team
is issuing releases for
`Django 5.2.8 <https://docs.djangoproject.com/en/dev/releases/5.2.8/>`_,
`Django 5.1.14 <https://docs.djangoproject.com/en/dev/releases/5.1.14/>`_,
and
`Django 4.2.26 <https://docs.djangoproject.com/en/dev/releases/4.2.26/>`_.
These releases address the security issues detailed below. We encourage all
users of Django to upgrade as soon as possible.

CVE-2025-64458: Potential denial-of-service vulnerability in
``HttpResponseRedirect`` and ``HttpResponsePermanentRedirect`` on Windows
======================================================================================================================================

`NFKC normalization <
https://docs.python.org/3/library/unicodedata.html#unicodedata.normalize>`_
in Python is slow on Windows. As a consequence, ``HttpResponseRedirect``,
``HttpResponsePermanentRedirect``, and ``redirect`` were subject to a
potential denial-of-service attack
via certain inputs with a very large number of Unicode characters.

Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report.

This issue has severity "moderate" according to the Django security policy.

CVE-2025-64459: Potential SQL injection via ``_connector`` keyword argument
in ``QuerySet`` and ``Q`` objects
=============================================================================================================

The methods ``QuerySet.filter()``, ``QuerySet.exclude()``, and
``QuerySet.get()``,
and the class ``Q()`` were subject to SQL injection when using a suitably
crafted
dictionary, with dictionary expansion, as the ``_connector`` argument.

Thanks to cyberstan for the report.

This issue has severity "high" according to the Django security policy.


Affected supported versions
===========================

* Django main
* Django 6.0 (currently at beta status)
* Django 5.2
* Django 5.1
* Django 4.2

Resolution
==========

Patches to resolve the issue have been applied to Django's
main, 6.0 (currently at beta status), 5.2, 5.1, and 4.2 branches.
The patches may be obtained from the following changesets.

CVE-2025-64458: Potential denial-of-service vulnerability in
``HttpResponseRedirect`` and ``HttpResponsePermanentRedirect`` on Windows
--------------------------------------------------------------------------------------------------------------------------------------

* On the `main branch <
https://github.com/django/django/commit/c880530ddd4fabd5939bab0e148bebe36699432a
> `__
* On the `6.0 branch <
https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f
> `__
* On the `5.2 branch <
https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac
> `__
* On the `5.1 branch <
https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
> `__
* On the `4.2 branch <
https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7
> `__

CVE-2025-64459: Potential SQL injection via ``_connector`` keyword argument
in ``QuerySet`` and ``Q`` objects
-------------------------------------------------------------------------------------------------------------

* On the `main branch <
https://github.com/django/django/commit/98e642c69181c942d60a10ca0085d48c6b3068bb
> `__
* On the `6.0 branch <
https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85
> `__
* On the `5.2 branch <
https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b
> `__
* On the `5.1 branch <
https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241
> `__
* On the `4.2 branch <
https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4
> `__


The following releases have been issued
=======================================

* Django 5.2.8 (`download Django 5.2.8
  <https://www.djangoproject.com/download/5.2.8/tarball/>`_ |
  `5.2.8 checksums
  <https://www.djangoproject.com/download/5.2.8/checksum/>`_)
* Django 5.1.14 (`download Django 5.1.14
  <https://www.djangoproject.com/download/5.1.14/tarball/>`_ |
  `5.1.14 checksums
  <https://www.djangoproject.com/download/5.1.14/checksum/>`_)
* Django 4.2.26 (`download Django 4.2.26
  <https://www.djangoproject.com/download/4.2.26/tarball/>`_ |
  `4.2.26 checksums
  <https://www.djangoproject.com/download/4.2.26/checksum/>`_)

The PGP key ID used for this release is Natalia Bidart: `2EE82A8D9470983E <
https://github.com/nessita.gpg>`_


General notes regarding security reporting
==========================================

As always, we ask that potential security issues be reported via private
email
to ``security () djangoproject com``, and not via Django's Trac instance, nor
via
the Django Forum. Please see `our security policies
<https://www.djangoproject.com/security/>`_ for further information.