A vulnerability in the Django XML deserializer exposes applications to remote denial-of-service attacks via resource exhaustion.

This issue involves inefficient algorithmic complexity within the django.core.serializers.xml_serializer.getInnerText() function, which can be triggered by an unauthenticated remote attacker submitting malicious XML payloads.

The vulnerability poses a significant risk to service availability, as successful exploitation can lead to severe CPU and memory exhaustion. This could result in application downtime, impacting business continuity and user access to critical services. Given the CVSS score of 7.5, this high-severity flaw requires prompt attention to prevent potential service disruption.

Immediate Action: Upgrade to Django versions 5.2.9, 5.1.15, or 4.2.27 as appropriate for your current environment.

Proactive Monitoring: Monitor server resource utilization, specifically CPU and memory spikes, during periods of high XML input processing to identify potential exploitation attempts.

Compensating Controls: Implement strict input validation or size limits on incoming XML requests at the Web Application Firewall or load balancer level to drop payloads that deviate from expected schemas.

Public Exploit Available: Unknown

Organizations should prioritize upgrading to the patched versions of Django immediately to eliminate the risk of denial-of-service. If an immediate upgrade is not feasible, ensure that input validation controls are in place to inspect and reject suspicious XML traffic before it reaches the application layer.