An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
References
| Link | Resource |
|---|---|
| https://docs.djangoproject.com/en/dev/releases/security/ | Vendor Advisory |
| https://groups.google.com/g/django-announce | Vendor Advisory |
| https://www.djangoproject.com/weblog/2025/apr/02/security-releases/ | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2025/04/02/2 | Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
03 Oct 2025, 15:34
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* |
|
| First Time |
Djangoproject django
Microsoft windows Djangoproject Microsoft |
|
| References | () https://docs.djangoproject.com/en/dev/releases/security/ - Vendor Advisory | |
| References | () https://groups.google.com/g/django-announce - Vendor Advisory | |
| References | () https://www.djangoproject.com/weblog/2025/apr/02/security-releases/ - Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2025/04/02/2 - Mailing List, Third Party Advisory | |
| Summary |
|
02 Apr 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Apr 2025, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-02 13:15
Updated : 2025-10-03 15:34
NVD link : CVE-2025-27556
Mitre link : CVE-2025-27556
CVE.ORG link : CVE-2025-27556
JSON object : View
Products Affected
microsoft
- windows
djangoproject
- django
CWE
CWE-770
Allocation of Resources Without Limits or Throttling