CVE-2025-14550Djangoproject Django
NVDCVSS scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Vulnerability Summary
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
`ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Jiyong Yang for reporting this issue.
`ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Jiyong Yang for reporting this issue.
CVSS v3.1 Base Metrics — Score 7.5 (HIGH)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HAttack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
Affected & Patched Versions
- Djangoproject Django >= 4.2 and < 4.2.28
- Djangoproject Django >= 5.2 and < 5.2.11
- Djangoproject Django >= 6.0 and < 6.0.2
- Djangoproject Django 4.2.28
- Djangoproject Django 5.2.11
- Djangoproject Django 6.0.2
What to do
Plan remediation soon. No exploitation is confirmed yet, but the severity is high.
- Check whether you run Djangoproject Django and which version.
- Update to a patched version listed above, then confirm the new version.
Timeline
- Feb 3, 2026Published
- Feb 4, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new Djangoproject Django CVEsYou are reading CVE-2025-14550. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsRelated Coverage
External References
Data last checked: Nov 15, 2026 03:31 UTC