CVE-2025-27556: Django Denial-of-Service Vulnerability Due to Slow NFKC Normalization
Summary
CVE-2025-27556: An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. Affects django across 2 version ranges.
>= 5.0, < 5.0.14
>= 5.1, < 5.1.8
Fixed in 5.0.14 or 5.1.8, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
The same CVE-2025-27556 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an authentication system, URL routing, and templating. However, certain versions of Django are vulnerable to a denial-of-service attack due to slow NFKC normalization on Windows, affecting specific views related to authentication and language settings.
Vulnerability Detail
An issue was discovered in Django versions 5.1 before 5.1.8 and 5.0 before 5.0.14, where the NFKC normalization process is slow on Windows systems. This vulnerability allows an attacker to exploit the django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language views by sending inputs with a large number of Unicode characters, potentially leading to a denial-of-service condition.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.0, < 5.0.145.0.14pip install --upgrade "django==5.0.14" -
>= 5.1, < 5.1.85.1.8pip install --upgrade "django==5.1.8"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the number of Unicode characters accepted in user inputs for the affected views. This can be done by implementing input validation in your forms or views to reject excessively long inputs.
Conclusion
The vulnerability identified as CVE-2025-27556 poses a significant risk to Django applications running on Windows due to slow NFKC normalization, which can lead to denial-of-service attacks. It is crucial to update to the latest patched versions of Django to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for django →
FAQ
Django versions 5.1 before 5.1.8 and 5.0 before 5.0.14 are affected by this vulnerability.
NFKC normalization is a process that transforms Unicode text into a canonical form, which can be important for consistent string comparison and processing.
An attacker can exploit this vulnerability by sending requests with a large number of Unicode characters to specific Django views, potentially causing the application to become unresponsive.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update Django right away, implement input validation to limit the number of Unicode characters accepted in the affected views as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for django.
