CVE-2025-27556: Django: Potential DoS in LoginView, LogoutView, and set_language() on Windows
An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.setlanguage are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27556?
CVE-2025-27556 is considered a moderate severity vulnerability due to its potential for denial-of-service attacks.
How do I fix CVE-2025-27556?
To fix CVE-2025-27556, upgrade Django to version 5.1.8 or 5.0.14 or later.
Which versions of Django are affected by CVE-2025-27556?
CVE-2025-27556 affects Django versions prior to 5.1.8 and 5.0 prior to 5.0.14.
What functionality in Django does CVE-2025-27556 impact?
CVE-2025-27556 impacts the LoginView, LogoutView, and set_language functionalities.
Is there a known workaround for CVE-2025-27556?
No specific workaround is provided for CVE-2025-27556; the recommended action is to upgrade to a patched version.