CVE-2025-64460 is a denial-of-service vulnerability affecting Red Hat Ansible Automation Platform 2.5, stemming from a flaw in Django's XML Deserializer component. The vulnerability arises from algorithmic complexity issues (CWE-407) that can be exploited by remote attackers providing specially crafted XML input, leading to CPU and memory exhaustion. Red Hat has classified this vulnerability as important and has not yet provided an official fix, citing lack of suitable mitigation options that meet their deployment and stability criteria. The vulnerability impacts products that process XML input using Django's XML Deserializer, including Red Hat Ansible Automation Platform 2.5. The CVSS v3 base score assigned by Red Hat is 7.5 (high severity) with an attack vector of network, low attack complexity, no privileges required, and no user interaction needed. No known exploits are reported in the wild.

The vulnerability allows remote attackers to cause denial-of-service conditions by exhausting CPU and memory resources through specially crafted XML input processed by Django's XML Deserializer. This can disrupt availability of affected Red Hat products, including Ansible Automation Platform 2.5. There is no impact on confidentiality or integrity reported. No known active exploitation has been observed.

Currently, no official fix or effective mitigation is available that meets Red Hat's criteria for ease of deployment and stability. Users should ensure all previously released errata and updates relevant to their system are applied. Monitoring Red Hat advisories for future updates or fixes is recommended. Customers with Red Hat Technical Account Managers (TAM) can seek direct guidance. No workaround or configuration change has been documented as effective at this time.