Vulnerability advisory

CVE-2026-25673

Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows

Published Mar 3, 2026Updated Oct 28, 2026OSV record ↗

Also known as BIT-django-2026-25673GHSA-8p8v-wh79-9r56PYSEC-2026-2448

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/django/django ↗
36b5f39d9372147f0e758f590e35ee2b2bc317dd to before a0d3bdb5b0a22cdbb4d3f7e5eabd7fe0f7311f68	`a0d3bdb5b0a22cdbb4d3f7e5eabd7fe0f7311f68`
9e7cc2b628fe8fd3895986af9b7fc9525034c1b0 to before 4f382ca672f86dd4a1e4d071c91d0caad0e124b3	`4f382ca672f86dd4a1e4d071c91d0caad0e124b3`
97aa3b7f08f51669e118f3af5ca91026e39664c3 to before f2ec75efbcf4d1ed63f135e5f8ff5f0463175312	`f2ec75efbcf4d1ed63f135e5f8ff5f0463175312`
Also listed as affected (15) `5.2.11` `6.0.2` `6.0.1` `5.2.10` `6.0` `5.2.9` `5.2.8` `5.2.7` `5.2.6` `5.2.5` `5.2.4` `5.2.3` `5.2.2` `5.2.1` `5.2`

Description

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. URLField.to_python() in Django calls urllib.parse.urlsplit(), which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial of service via large URL inputs containing these characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

CVE-2026-25673

Affected versions

Repository

Description

References