Denial-of-Service Vulnerability in Django Authentication Views

CVE-2025-27556

What is CVE-2025-27556?

A vulnerability has been identified in Django versions prior to 5.1.8 and 5.0.14, where NFKC normalization can be exploited on Windows systems, potentially leading to a Denial-of-Service attack. Specifically, the django.contrib.auth.views.LoginView and LogoutView, along with django.views.i18n.set_language, are susceptible to performance degradation if exposed to inputs containing a substantial number of Unicode characters. This flaw underscores the importance of safeguarding against potential input overloads to maintain application integrity.

References