CVE-2025-27556
CVE-2025-27556
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
CVSS 5.8 · Medium · EPSS 1.1% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
django
- Versions
- ≥ 5.0, < 5.0.14: Affected (custom)
- ≥ 5.1, < 5.1.8: Affected (custom)
Update to 5.0.14; Update to 5.1.8
django PyPI
- Versions
- 5.0
- 5.0.1
- 5.0.10
- 5.0.11
- 5.0.12
- 5.0.13
- 5.0.2
- 5.0.3
- 5.0.4
- 5.0.5
- 5.0.6
- 5.0.7
- 5.0.8
- 5.0.9
- Affected ranges
- ECOSYSTEM: ≥ 5.0, < 5.0.14
Update to 5.0.14
django PyPI
- Versions
- 5.1
- 5.1.1
- 5.1.2
- 5.1.3
- 5.1.4
- 5.1.5
- 5.1.6
- 5.1.7
- Affected ranges
- ECOSYSTEM: ≥ 5.1, < 5.1.8
Update to 5.1.8
django PyPI
- Versions
- 5.0
- 5.0.1
- 5.0.10
- 5.0.11
- 5.0.12
- 5.0.13
- 5.0.2
- 5.0.3
- 5.0.4
- 5.0.5
- 5.0.6
- 5.0.7
- 5.0.8
- 5.0.9
- 5.1
- 5.1.1
- 5.1.2
- 5.1.3
- 5.1.4
- 5.1.5
- 5.1.6
- 5.1.7
- Affected ranges
- ECOSYSTEM: ≥ 5.1, < 5.1.8 ∪ ≥ 5.0, < 5.0.14
Update to 5.1.8; Update to 5.0.14