Denial-of-Service Vulnerability in Django Framework by Django Software Foundation

CVE-2025-14550

What is CVE-2025-14550?

A vulnerability has been discovered in multiple versions of the Django web framework, where the ASGIRequest component is susceptible to a denial-of-service attack. A remote attacker can exploit this flaw by sending a specially crafted request with multiple duplicate headers, potentially overwhelming the server's ability to process requests. Affected versions include 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Earlier versions, such as 5.0.x, 4.1.x, and 3.2.x, are also likely affected but have not been assessed due to being unsupported. Django acknowledges Jiyong Yang for identifying this issue.

References