Listen to this Post
The vulnerability is an algorithmic complexity issue in the `django.core.serializers.xml_serializer.getInnerText()` function. When the XML deserializer processes input, this function recursively collects text from XML nodes. The vulnerability stems from using repeated string concatenation within this recursion. In Python, strings are immutable, so each concatenation creates an entirely new string object. When processing a maliciously crafted XML document containing many deeply nested elements or numerous text nodes, this leads to quadratic time complexity (O(n²)). An attacker can exploit this by submitting such specially crafted XML to any application endpoint that uses Django’s XML deserializer. This causes superlinear growth in computation, exhausting CPU resources and consuming significant memory, leading to a complete denial-of-service condition where the application becomes unresponsive.
dailycve form:
Platform: Django
Version: <5.2.9, <5.1.15, <4.2.27
Vulnerability: Denial-of-Service
Severity: Moderate
date: 2025-12-02
Prediction: 2025-12-02
What Undercode Say:
Analytics:
Check current Django version python -m django --version python manage.py --version python -c "import django; print(django.get_version())" Update to patched version pip install --upgrade Django==5.2.9 pip install --upgrade Django==5.1.15 pip install --upgrade Django==4.2.27
How Exploit:
Crafted XML input with deeply nested elements or many text nodes submitted to XML deserializer endpoint triggers inefficient recursive string concatenation in getInnerText().
Protection from this CVE:
Upgrade Django to version 5.2.9, 5.1.15, or 4.2.27. The patch optimizes `getInnerText()` to collect text per element, avoiding quadratic complexity.
Impact:
High availability impact causing service outage via CPU/memory exhaustion. No confidentiality or integrity impact.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
