Executive brief
Django, a popular web framework, is vulnerable to a denial-of-service attack when running on Windows. An attacker can send specially crafted web requests containing a large number of specific Unicode characters to overwhelm the server's processor. This can cause the website to become slow or completely unresponsive, disrupting business operations and service availability.
Technical details
A denial-of-service (DoS) vulnerability exists in Django when deployed on Windows systems. The root cause is the slow performance of NFKC (Normalization Form Compatibility Composition) normalization in Python on Windows. An attacker can exploit this by providing inputs containing a very large number of Unicode characters to `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, or the `django.shortcuts.redirect` shortcut. This triggers inefficient algorithmic complexity (CWE-407), leading to excessive CPU consumption and service exhaustion. The issue is fixed in versions 4.2.26, 5.1.14, and 5.2.8.
Affected products
- Django Software Foundation Django < 4.2.26, >= 5.0a1, < 5.1.14, >= 5.2a1, < 5.2.8
Timeline
- 2025-11-05: disclosed
- 2025-11-05: advisory
- 2025-11-05: patched
References
- https://docs.djangoproject.com/en/dev/releases/security
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2025/nov/05/security-releases
- https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
- https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac