CVE-2025-14550
unknown
CVSS v3
—
CVSS v2
—
VIR risk
—
Description
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2025-14550
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2025-14550.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| debian | bookworm | fixed | 3:3.2.25-0+deb12u2 |
| debian | bullseye | fixed | 0 |
| debian | forky | fixed | 3:4.2.28-1 |
| debian | sid | fixed | 3:4.2.28-1 |
| debian | trixie | fixed | 3:4.2.28-0+deb13u1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-14550
- https://github.com/django/django/commit/eb22e1d6d643360e952609ef562c139a100ea4eb
- https://docs.djangoproject.com/en/dev/releases/security
- https://github.com/django/django
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2026/feb/03/security-releases
- https://docs.djangoproject.com/en/dev/releases/security/
- https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
- https://www.suse.com/security/cve/CVE-2025-14550.html
- https://security-tracker.debian.org/tracker/CVE-2025-14550
Verify integrity in audit chain (admin only). AS-IS.