PT-2025-14483 · Django+1 · Django+1

Sw0Rd1Ight · Published 2025-04-02 · Updated 2026-01-03 · CVE-2025-27556

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Django versions 5.1 before 5.1.8 Django versions 5.0 before 5.0.14

Description An issue was discovered where the NFKC normalization is slow on Windows, making certain views subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. The affected views include django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set language.

Recommendations For Django versions 5.1 before 5.1.8, update to version 5.1.8 or later. For Django versions 5.0 before 5.0.14, update to version 5.0.14 or later.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALT-PU-2025-10176

BDU:2025-05049

BIT-DJANGO-2025-27556

CVE-2025-27556

GHSA-WQFG-M96J-85VM

OPENSUSE-SU-2025:14986-1

OPENSUSE-SU-2026:10005-1

PYSEC-2025-14

Affected Products

Alt Linux

Django

References · 94

• https://bdu.fstec.ru/vul/2025-05049 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27556 · Vendor Advisory
• https://djangoproject.com/weblog/2025/apr/02/security-releases · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-14 · Vendor Advisory
• https://groups.google.com/g/django-announce · Vendor Advisory
• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14986-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-django-2025-27556 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10005-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27556 · Security Note
• https://osv.dev/vulnerability/GHSA-wqfg-m96j-85vm · Vendor Advisory
• https://github.com/django/django · Note
• https://github.com/django/django/commit/edc2716d01a6fdd84b173c02031695231bcee1f8 · Note
• https://github.com/django/django/commit/8c6871b097b6c49d2a782c0d80d908bcbe2116f1 · Note
• https://github.com/django/django/commit/2cb311f7b069723027fb5def4044d1816d7d2afd · Note