CVE-2026-25673

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-25673
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial of service via large URL inputs containing these characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://docs.djangoproject.com/en/dev/releases/security/ Patch Vendor Advisory
https://groups.google.com/g/django-announce Release Notes
https://www.djangoproject.com/weblog/2026/mar/03/security-releases/ Patch Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-25673
https://bugzilla.redhat.com/show_bug.cgi?id=2444115
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25673.json
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
History

30 Jun 2026, 03:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/security/cve/CVE-2026-25673 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2444115 -
  • () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25673.json -

17 Jun 2026, 10:25

Type Values Removed Values Added
References () https://docs.djangoproject.com/en/dev/releases/security/ - Vendor Advisory, Patch () https://docs.djangoproject.com/en/dev/releases/security/ - Patch, Vendor Advisory
Summary
  • (es) Se descubrió un problema en 6.0 anterior a 6.0.3, 5.2 anterior a 5.2.12, y 4.2 anterior a 4.2.29. `URLField.to_python()` en Django llama a `urllib.parse.urlsplit()`, que realiza la normalización NFKC en Windows, la cual es desproporcionadamente lenta para ciertos caracteres Unicode, permitiendo a un atacante remoto causar denegación de servicio a través de grandes entradas de URL que contienen estos caracteres. Series de Django anteriores y no compatibles (como 5.0.x, 4.1.x y 3.2.x) no fueron evaluadas y también podrían estar afectadas. Django desea agradecer a Seokchan Yoon por informar sobre este problema.

05 Mar 2026, 14:12

Type Values Removed Values Added
CPE cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
CWE CWE-770
First Time Djangoproject django
Djangoproject
References () https://docs.djangoproject.com/en/dev/releases/security/ - () https://docs.djangoproject.com/en/dev/releases/security/ - Vendor Advisory, Patch
References () https://groups.google.com/g/django-announce - () https://groups.google.com/g/django-announce - Release Notes
References () https://www.djangoproject.com/weblog/2026/mar/03/security-releases/ - () https://www.djangoproject.com/weblog/2026/mar/03/security-releases/ - Patch, Vendor Advisory

03 Mar 2026, 16:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

03 Mar 2026, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-03 15:16

Updated : 2026-07-15 02:18

NVD link : CVE-2026-25673

Mitre link : CVE-2026-25673

CVE.ORG link : CVE-2026-25673

JSON object : View

Products Affected

djangoproject

  • django
CWE
CWE-400

Uncontrolled Resource Consumption

CWE-770

Allocation of Resources Without Limits or Throttling