CVE-2025-27556

An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

• CWE-770

• https://docs.djangoproject.com/en/dev/releases/security/Vendor Advisory
• https://groups.google.com/g/django-announceVendor Advisory
• https://www.djangoproject.com/weblog/2025/apr/02/security-releases/Vendor Advisory
• http://www.openwall.com/lists/oss-security/2025/04/02/2Mailing List, Third Party Advisory

Published

Apr 2, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27550IBM Jazz Reporting Service could allow an authenticated user…3.5
• CVE-2025-27551DBIx::Class::EncodedColumn use the rand() function, which is…4
• CVE-2025-27552DBIx::Class::EncodedColumn use the rand() function, which is…4
• CVE-2025-27553Relative Path Traversal vulnerability in Apache Commons VFS …7.5
• CVE-2025-27554ToDesktop before 2024-10-03, as used by Cursor before 2024-1…9.9
• CVE-2025-27555Airflow versions before 2.11.1 have a vulnerability that all…6.5
• CVE-2025-27558IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks agai…9.1
• CVE-2025-27559Incorrect default permissions for some AI Playground softwar…6.7
• CVE-2025-2756A vulnerability classified as critical has been found in Ope…8.8
• CVE-2025-27560Loop with unreachable exit condition ('infinite loop') for s…6.7
• CVE-2025-27561Unauthenticated attackers can rename "rooms" of arbitrary us…6.9
• CVE-2025-27562in OpenHarmony v5.0.3 and prior versions allow a local attac…5.5