Vulnerability advisory

GHSA-wqfg-m96j-85vm

Django Potential Denial of Service (DoS) on Windows

Published Apr 2, 2025Updated Sep 25, 2025OSV record ↗

Also known as BIT-django-2025-27556CVE-2025-27556PYSEC-2025-14

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Affected versions

django PyPI

All django advisories →

Affected	Fixed in
`5.0` to before 5.0.14	`5.0.14`Advisories →
Also listed as affected (14) `5.0` `5.0.1` `5.0.10` `5.0.11` `5.0.12` `5.0.13` `5.0.2` `5.0.3` `5.0.4` `5.0.5` `5.0.6` `5.0.7` `5.0.8` `5.0.9`
`5.1` to before 5.1.8	`5.1.8`Advisories →
Also listed as affected (8) `5.1` `5.1.1` `5.1.2` `5.1.3` `5.1.4` `5.1.5` `5.1.6` `5.1.7`

Description

An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

GHSA-wqfg-m96j-85vm

Affected versions

django PyPI

Description

References