Executive brief
A vulnerability in the Django web framework can allow an attacker to crash or slow down a website running on Windows. By submitting specially crafted, large web addresses (URLs) containing specific Unicode characters, an attacker can trigger an extremely slow processing task that consumes server resources. This results in a denial of service, making the application unavailable to legitimate users.
Technical details
A denial of service (DoS) vulnerability exists in Django's `URLField.to_python()` method when running on Windows. The component calls `urllib.parse.urlsplit()`, which performs NFKC normalization. On Windows, this process is disproportionately slow when handling certain Unicode characters. A remote, unauthenticated attacker can exploit this by submitting large URL inputs containing these specific characters, leading to uncontrolled resource consumption and service exhaustion. The issue is fixed in Django versions 6.0.3, 5.2.12, and 4.2.29.
Affected products
- Django Software Foundation Django 6.0 before 6.0.3, 5.2 before 5.2.12, 4.2 before 4.2.29
Timeline
- 2026-03-03: disclosed
- 2026-03-03: patched
- 2026-03-03: advisory
References
- https://pypi.org/project/Django/
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2026/mar/03/security-releases/
- https://access.redhat.com/security/cve/CVE-2026-25673
- https://bugzilla.redhat.com/show_bug.cgi?id=2444115
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25673.json