PYSEC-2025-14 — Vulnetix

PYSEC-2025-14 PUBLISHED CVSS 8.699999809265137 HIGH

An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

Risk Scores

CVSS v4.0

8.699999809265137

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Products

Vendor	Product	Versions
PyPI	django	5.1, 5.0, 5.0

Timeline

Apr 2, 2025 CVE Published
Sep 25, 2025 CVE Updated

References

https://www.djangoproject.com/weblog/2025/apr/02/security-releases/ article
https://docs.djangoproject.com/en/dev/releases/security/ url
https://groups.google.com/g/django-announce url
http://www.openwall.com/lists/oss-security/2025/04/02/2 url

Open in Interactive Console →