GHSA-wqfg-m96j-85vm

Source

https://github.com/advisories/GHSA-wqfg-m96j-85vm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-wqfg-m96j-85vm/GHSA-wqfg-m96j-85vm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wqfg-m96j-85vm

Aliases

Published

2025-04-02T15:31:37Z

Modified

2025-09-25T09:27:20.004567Z

Severity

5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L CVSS Calculator

Summary

Django Potential Denial of Service (DoS) on Windows

Details

An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

Database specific

{
    "github_reviewed_at": "2025-04-02T20:11:40Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-770"
    ],
    "nvd_published_at": "2025-04-02T13:15:44Z",
    "severity": "MODERATE"
}

References

Affected packages

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0

Fixed

5.0.14

Affected versions

5.*

5.0

5.0.1

5.0.2

5.0.3

5.0.4

5.0.5

5.0.6

5.0.7

5.0.8

5.0.9

5.0.10

5.0.11

5.0.12

5.0.13

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-wqfg-m96j-85vm/GHSA-wqfg-m96j-85vm.json"

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.1

Fixed

5.1.8

Affected versions

5.*

5.1

5.1.1

5.1.2

5.1.3

5.1.4

5.1.5

5.1.6

5.1.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-wqfg-m96j-85vm/GHSA-wqfg-m96j-85vm.json"