CVE-2025-27556: Django Denial of Service Vulnerability on Windows Systems
Summary
CVE-2025-27556: Django Potential Denial of Service (DoS) on Windows. Affects django across 2 version ranges.
>= 5.0, < 5.0.14
>= 5.1, < 5.1.8
Fixed in 5.0.14 or 5.1.8, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
The same CVE-2025-27556 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features, including an authentication system, URL routing, and an ORM for database interactions. However, certain versions of Django are vulnerable to a Denial of Service (DoS) attack on Windows due to slow NFKC normalization, which can be exploited through specific inputs containing a large number of Unicode characters.
Vulnerability Detail
The vulnerability arises from the NFKC normalization process in Django versions 5.1 before 5.1.8 and 5.0 before 5.0.14, which is notably slow on Windows systems. This slowness can be exploited by attackers to create inputs that cause the LoginView, LogoutView, and set_language functions to hang or crash, leading to a potential denial-of-service condition. The impact of this vulnerability is moderate, as it can disrupt service availability for users.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.0, < 5.0.145.0.14pip install --upgrade "django==5.0.14" -
>= 5.1, < 5.1.85.1.8pip install --upgrade "django==5.1.8"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the input size for the affected views to prevent the processing of excessively large Unicode character inputs. This can be implemented by adding validation checks in your view functions to restrict the length of input data.
Conclusion
In summary, the Django vulnerability CVE-2025-27556 poses a moderate risk of denial-of-service attacks on Windows systems. It is crucial for developers using affected versions to update to the latest patched versions to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround while updates are applied.
See every vulnerability recorded for django →
FAQ
The CVSS score of this vulnerability is 5.8, indicating a moderate severity level.
Django versions 5.1 before 5.1.8 and 5.0 before 5.0.14 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential consequences include service disruption and denial of access for users due to the slow processing of certain inputs.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
