CVE-2025-13473Disclosure(djangoproject / django)

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch djangoproject django systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

djangoproject CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Other references

https://groups.google.com/g/django-announce

Weakness type (CWE)

CWE-208

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

django

Threat summary

Patch or workaround signal is available
4 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 2 classified signals
Peaked 3d ago at 1 mentions (2026-02-03); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

djangoproject

Products

django

Deep dive

Activity timeline4 mentions / 4d

Signal classification2 categories

Disclosure

250.0%

Patch

250.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-03	1	Disclosure1
2026-02-05	1	Patch1
2026-02-08	1	Disclosure1
2026-02-28	1	Patch1

Full discourse4 posts

Open Source Security mailing list@oss_security243d
Disclosure
6 CVEs in Django https://www.openwall.com/lists/oss-security/2026/02/03/1 CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentication handler CVE-2025-14550: Potential DoS via repeated headers when using ASGI CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS
Post summary
Three new Django CVEs were disclosed, covering username enumeration, DoS via repeated headers, and SQL injection through PostGIS raster lookups.
14081879
4.4K followersView on X
ThreatCluster@threatcluster223d
Patch
Fedora releases Django security updates fixing CVE-2025-13473, -14550 and CVE-2026-1207, addressing username enumeration, DoS and SQL injection. Update now. #Django https://threatcluster.io/cluster/fedora-django-framework-security-fixes-released-8c60bb1a
Post summary
Fedora has released updates to Django that fix CVE-2025-13473, CVE-2025-14550, and CVE-2026-1207, addressing username enumeration, denial‑of‑service, and SQL injection vulnerabilities. Users are advised to update their installations promptly.
00000133
83 followersView on X
Ferramentas Linux@Cezar_H_Linux245d
Patch
CRITICAL: CVE-2025-13473 for #OpenSUSE (#Python 3.12/Django 6.6.0.2) allows remote code execution. Patch NOW. Read more: 👉 https://tinyurl.com/ypa8zmdx #Security https://t.co/HchIFZ1uJ4
Post summary
The tweet alerts that CVE‑2025‑13473 is a critical RCE vulnerability affecting OpenSUSE, Python 3.12, and Django 6.6.0.2, urging users to patch immediately with a provided link.
00000101
1.3K followersView on X
CVE@CVEnew248d
Disclosure
CVE-2025-13473 An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authen… https://www.cve.org/CVERecord?id=CVE-2025-13473
Post summary
The text announces CVE-2025-13473 as affecting various Django releases via the modwsgi.check_password function, without any PoC, exploit, patch, or evidence of active exploitation.
00000170
56.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	djangoproject	django	-	-	-

Explore more

Back to dashboard djangoproject CVEs django vulnerabilities

What researchers are saying

CVE-2025-13473

ThreatCluster[verified]@threatclusterPatch

Fedora has released updates to Django that fix CVE-2025-13473, CVE-2025-14550, and CVE-2026-1207, addressing username enumeration, denial‑of‑service, and SQL injection vulnerabilities. Users are advised to update their installations promptly.

Open Source Security mailing list@oss_securityDisclosure

Three new Django CVEs were disclosed, covering username enumeration, DoS via repeated headers, and SQL injection through PostGIS raster lookups.

Ferramentas Linux@Cezar_H_LinuxPatch

The tweet alerts that CVE‑2025‑13473 is a critical RCE vulnerability affecting OpenSUSE, Python 3.12, and Django 6.6.0.2, urging users to patch immediately with a provided link.

CVE@CVEnewDisclosure

The text announces CVE-2025-13473 as affecting various Django releases via the modwsgi.check_password function, without any PoC, exploit, patch, or evidence of active exploitation.