CVE-2025-27556

Published: Apr 2, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

Affected (2)

Products: Djangoproject: Django

1 product

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Djangoproject Django	From 5.0 to 5.0.14
Djangoproject Django	From 5.1 to 5.1.8

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

https://docs.djangoproject.com/en/dev/releases/security/

Source: cve@mitre.org

Vendor Advisory

https://groups.google.com/g/django-announce

Source: cve@mitre.org

Vendor Advisory

https://www.djangoproject.com/weblog/2025/apr/02/security-releases/

Source: cve@mitre.org

Vendor Advisory

http://www.openwall.com/lists/oss-security/2025/04/02/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.