CVE-2026-25673

NameCVE-2026-25673
DescriptionAn issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial of service via large URL inputs containing these characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-django (PTS)bullseye2:2.2.28-1~deb11u2fixed
bullseye (security)2:2.2.28-1~deb11u12fixed
bookworm3:3.2.19-1+deb12u1fixed
bookworm (security)3:3.2.25-0+deb12u2fixed
trixie3:4.2.23-1fixed
trixie (security)3:4.2.28-0+deb13u1fixed
forky3:4.2.28-1fixed
sid3:4.2.29-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-djangosource(unstable)(not affected)

Notes

- python-django <not-affected> (Windows-specific)
https://www.djangoproject.com/weblog/2026/mar/03/security-releases/

Search for package or bug name: Reporting problems