CVE-2025-27556
Django Potential Denial of Service (DoS) on Windows
An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
- Record
CVE-2025-27556- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2025-9536
An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
- Record
EUVD-2025-9536- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wqfg-m96j-85vm
Django Potential Denial of Service (DoS) on Windows
An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
- Record
GHSA-wqfg-m96j-85vm- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
- Record
CVE-2025-27556- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
- Record
CVE-2025-27556- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-wqfg-m96j-85vm
Django Potential Denial of Service (DoS) on Windows
An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
- Record
GHSA-wqfg-m96j-85vm- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 10 moreShow less
OSVBIT-django-2025-27556 No score
An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
- Record
BIT-django-2025-27556- Updated
- 2026-11-02
OSVCLSA-2025-1760919102 No score
TuxCare security update for django (2 CVEs)
TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.post2+tuxcare.
- Record
CLSA-2025-1760919102- Updated
- 2026-11-02
OSVCLSA-2026-1788169795 No score
TuxCare security update for django (11 CVEs)
TuxCare rebuilt django to address 11 CVEs. Fixed in 5.0.2.post6+tuxcare.
- Record
CLSA-2026-1788169795- Updated
- 2026-11-02
OSVCLSA-2026-1788171127 No score
TuxCare security update for django (4 CVEs)
TuxCare rebuilt django to address 4 CVEs. Fixed in 5.1.4.post4+tuxcare.
- Record
CLSA-2026-1788171127- Updated
- 2026-11-02
OSVCLSA-2026-1789454744 No score
TuxCare security update for django (5 CVEs)
TuxCare rebuilt django to address 5 CVEs. Fixed in 5.0.1.post9+tuxcare.
- Record
CLSA-2026-1789454744- Updated
- 2026-11-02
OSVCLSA-2026-1789538082 No score
TuxCare security update for django (4 CVEs)
TuxCare rebuilt django to address 4 CVEs. Fixed in 5.0.post13+tuxcare.
- Record
CLSA-2026-1789538082- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14986-1 No score
python311-Django-5.1.8-1.1 on GA media
These are all security issues fixed in the python311-Django-5.1.8-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14986-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10005-1 No score
python312-Django6-6.0-1.1 on GA media
These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10005-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11270-1 No score
python313-Django5-5.2.16-1.1 on GA media
These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11270-1- Updated
- 2026-11-02
OSVPYSEC-2025-14 No score
An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
- Record
PYSEC-2025-14- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
5.0 up to 5.0.14 | 5.0.14 |
djangoPyPI |
5.1 up to 5.1.8 | 5.1.8 |
djangoBitnami |
5.0.0 up to 5.0.14, 5.1.0 up to 5.1.8 | 5.0.145.1.8 |
djangoTuxCare:PyPI From an advisory covering 2 CVEs |
5.1 up to 5.1.post2+tuxcare, plus listed versions 5.1.post1+tuxcare |
5.1.post2+tuxcare |
djangoTuxCare:PyPI From an advisory covering 11 CVEs |
5.0.2 up to 5.0.2.post6+tuxcare, plus listed versions 5.0.2.post1+tuxcare5.0.2.post2+tuxcare5.0.2.post3+tuxcare5.0.2.post4+tuxcare5.0.2.post5+tuxcare |
5.0.2.post6+tuxcare |
djangoTuxCare:PyPI From an advisory covering 4 CVEs |
5.1.4 up to 5.1.4.post4+tuxcare, plus listed versions 5.1.4.post1+tuxcare5.1.4.post2+tuxcare5.1.4.post3+tuxcare |
5.1.4.post4+tuxcare |
djangoTuxCare:PyPI From an advisory covering 5 CVEs |
5.0.1 up to 5.0.1.post9+tuxcare, plus listed versions 5.0.1.post1+tuxcare5.0.1.post2+tuxcare5.0.1.post3+tuxcare5.0.1.post4+tuxcare5.0.1.post5+tuxcare5.0.1.post6+tuxcare5.0.1.post7+tuxcare5.0.1.post8+tuxcare |
5.0.1.post9+tuxcare |
djangoTuxCare:PyPI From an advisory covering 4 CVEs |
5.0 up to 5.0.post13+tuxcare, plus listed versions 5.0.post1+tuxcare5.0.post10+tuxcare5.0.post11+tuxcare5.0.post12+tuxcare5.0.post2+tuxcare Show 7 moreShow less5.0.post3+tuxcare5.0.post4+tuxcare5.0.post5+tuxcare5.0.post6+tuxcare5.0.post7+tuxcare5.0.post8+tuxcare5.0.post9+tuxcare |
5.0.post13+tuxcare |
djangoPyPI |
5.0 up to 5.0.14, plus listed versions 5.0.15.0.105.0.115.0.125.0.13 Show 8 moreShow less5.0.25.0.35.0.45.0.55.0.65.0.75.0.85.0.9 |
5.0.14 |
djangoPyPI |
5.1 up to 5.1.8, plus listed versions 5.1.15.1.25.1.35.1.45.1.55.1.65.1.7 |
5.1.8 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
5.1 up to 5.1.8, 5.0 up to 5.0.14, plus listed versions 5.0.15.0.105.0.115.0.125.0.13 Show 15 moreShow less5.0.25.0.35.0.45.0.55.0.65.0.75.0.85.0.95.1.15.1.25.1.35.1.45.1.55.1.65.1.7 |
5.1.85.0.14 |
python-DjangoopenSUSE:Tumbleweed |
before 5.1.8-1.1 | 5.1.8-1.1 |
python-Django6openSUSE:Tumbleweed From an advisory covering 70 CVEs |
before 6.0-1.1 | 6.0-1.1 |
python-Django5openSUSE:Tumbleweed From an advisory covering 93 CVEs |
before 5.2.16-1.1 | 5.2.16-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-27556 is a medium vulnerability (CVSS 5.8) in Djangoproject Django, published April 2, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. Fixed in django 5.0.14.
References
docs.djangoproject.com/en/dev/releases/security
groups.google.com/g/django-announce
djangoproject.com/weblog/2025/apr/02/security-releases
openwall.com/lists/oss-security/2025/04/02/2
nvd.nist.gov/vuln/detail/CVE-2025-27556
github.com/django/django/commit/2cb311f7b069723027fb5def4044d1816d7d2afd
Show 101 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/44A5NGL2W236MIUIUS4UB3CVVCIFBWKP
suse.com/security/cve/CVE-2025-27556