Hi,

The following vulnerabilities were published for python-django.

CVE-2025-64458[0]:
| An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and
| 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows.
| As a consequence, `django.http.HttpResponseRedirect`,
| `django.http.HttpResponsePermanentRedirect`, and the shortcut
| `django.shortcuts.redirect`  were subject to a potential  denial-of-
| service attack via certain inputs with a very large number of
| Unicode characters. Earlier, unsupported Django series (such as
| 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be
| affected. Django would like to thank Seokchan Yoon for reporting
| this issue.


CVE-2025-64459[1]:
| An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and
| 5.2 before 5.2.8. The methods `QuerySet.filter()`,
| `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are
| subject to SQL injection when using a suitably crafted dictionary,
| with dictionary expansion, as the `_connector` argument. Earlier,
| unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not
| evaluated and may also be affected. Django would like to thank
| cyberstan for reporting this issue.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-64458
https://www.cve.org/CVERecord?id=CVE-2025-64458
[1] https://security-tracker.debian.org/tracker/CVE-2025-64459
https://www.cve.org/CVERecord?id=CVE-2025-64459
[2] https://www.djangoproject.com/weblog/2025/nov/05/security-releases/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore