CVE-2025-27556
Fixed in a distro release EPSS 1%CVSS 5.8
An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Products: djangoproject django
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 5.0.14 |
| PyPI | django | 5.1.8 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| openSUSE Tumbleweed | python-Django | 5.1.8-1.1 |
| openSUSE Tumbleweed | python-Django5 | 5.2.16-1.1 |
| openSUSE Tumbleweed | python-Django6 | 6.0-1.1 |