ch4n3-yoon/cve-2025-64458-demoA PoC script for demonstrating CVE 2025-64458, found in Django, potential DoS in `HttpResponseRedirect`/`HttpResponsePermanentRedirect` on Windows.
A denial-of-service (DoS) issue in Django’s redirect responses allows an attacker to trigger excessive CPU work during URL normalization when constructing redirect responses. On Windows, Python’s Unicode NFKC normalization is particularly slow. As a result, creating HttpResponseRedirect/HttpResponsePermanentRedirect (or using django.shortcuts.redirect()) with attacker‑controlled, very large Unicode URLs can cause pathological processing times, leading to request thread exhaustion and service slowdown/outage.
This issue is a follow‑up to CVE‑2025‑27556 and specifically impacts Windows due to the performance characteristics of unicodedata.normalize() on that platform.
next/return_to parameters, or app logic returning a redirect using untrusted input).HttpResponseRedirect (302) and HttpResponsePermanentRedirect (301), as well as django.shortcuts.redirect().poc.py) DemonstratesＡ), e.g., https://ＡＡ…/.HttpResponseRedirect(url), which triggers URL normalization (iri_to_uri()) and splitting (urlsplit()), exercising the slow path on Windows.DisallowedRedirect (see Patch Summary), preventing the expensive normalization work.HttpResponseRedirectBase.__init__:
MAX_URL_LENGTH from django.utils.http.str and raises DisallowedRedirect if len(redirect_to_str) > MAX_URL_LENGTH before calling urlsplit().DisallowedRedirect.