Vulnerability details
CVE-2026-25673
djangoproject Django
Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows
CVSS 3.1
7.5High
Official description
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial of service via large URL inputs containing these characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| djangoproject | Django | 4.2 ≤ v < 4.2.29 | CVEProject cvelistV5 (CNA) |
| djangoproject | Django | 5.2 ≤ v < 5.2.12 | CVEProject cvelistV5 (CNA) |
| djangoproject | Django | 6.0 ≤ v < 6.0.3 | CVEProject cvelistV5 (CNA) |
References and advisories
6- https://docs.djangoproject.com/en/dev/releases/security/ vendor-advisory
- https://groups.google.com/g/django-announce mailing-list
- https://www.djangoproject.com/weblog/2026/mar/03/security-releases/ vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-25673 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2444115 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25673.json x_sadp-csaf-vex
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-03-03
- Last updated
- 2026-07-15
- State
- Published
- Assigner (CNA)
- DSF
Exploit prediction (EPSS)
0.84%
Probability of exploitation in 30 days
58%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-400Uncontrolled Resource Consumption
- CWE-770Allocation of Resources Without Limits or Throttling