CVE-2026-25673: Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial of service via large URL inputs containing these characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25673?
CVE-2026-25673 is classified as a denial-of-service vulnerability affecting specific versions of Django.
How do I fix CVE-2026-25673?
To fix CVE-2026-25673, upgrade Django to version 6.0.3, 5.2.12, or 4.2.29 or later.
Which versions of Django are affected by CVE-2026-25673?
CVE-2026-25673 affects Django versions prior to 6.0.3, 5.2.12, and 4.2.29.
What component is vulnerable in CVE-2026-25673?
The vulnerability in CVE-2026-25673 arises from the URLField processing in Django.
What is the impact of CVE-2026-25673 on applications?
The impact of CVE-2026-25673 may lead to denial-of-service conditions affecting applications using vulnerable Django versions.