diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/5.0.14.txt | 10 | ||||
| -rw-r--r-- | docs/releases/5.1.8.txt | 10 |
2 files changed, 20 insertions, 0 deletions
diff --git a/docs/releases/5.0.14.txt b/docs/releases/5.0.14.txt index 8684a270dc..230bfed652 100644 --- a/docs/releases/5.0.14.txt +++ b/docs/releases/5.0.14.txt @@ -5,3 +5,13 @@ Django 5.0.14 release notes *April 2, 2025* Django 5.0.14 fixes a security issue with severity "moderate" in 5.0.13. + +CVE-2025-27556: Potential denial-of-service vulnerability in ``LoginView``, ``LogoutView``, and ``set_language()`` on Windows +============================================================================================================================= + +Python's :func:`NFKC normalization <python:unicodedata.normalize>` is slow on +Windows. As a consequence, :class:`~django.contrib.auth.views.LoginView`, +:class:`~django.contrib.auth.views.LogoutView`, and +:func:`~django.views.i18n.set_language` were subject to a potential +denial-of-service attack via certain inputs with a very large number of Unicode +characters. diff --git a/docs/releases/5.1.8.txt b/docs/releases/5.1.8.txt index 2aa6686cb6..b3b0327b52 100644 --- a/docs/releases/5.1.8.txt +++ b/docs/releases/5.1.8.txt @@ -7,6 +7,16 @@ Django 5.1.8 release notes Django 5.1.8 fixes a security issue with severity "moderate" and several bugs in 5.1.7. +CVE-2025-27556: Potential denial-of-service vulnerability in ``LoginView``, ``LogoutView``, and ``set_language()`` on Windows +============================================================================================================================= + +Python's :func:`NFKC normalization <python:unicodedata.normalize>` is slow on +Windows. As a consequence, :class:`~django.contrib.auth.views.LoginView`, +:class:`~django.contrib.auth.views.LogoutView`, and +:func:`~django.views.i18n.set_language` were subject to a potential +denial-of-service attack via certain inputs with a very large number of Unicode +characters. + Bugfixes ======== |