Denial of Service Risk in Django Framework by Large URL Inputs
CVE-2026-25673
What is CVE-2026-25673?
A vulnerability in the Django Framework affects versions 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29, specifically linked to the URLField.to_python() method. This method utilizes urllib.parse.urlsplit(), which performs NFKC normalization on Windows but becomes disproportionately slow when processing certain Unicode characters. An attacker could exploit this vulnerability by sending maliciously crafted large URL inputs, thereby potentially triggering a denial of service condition. Previous unsupported Django versions, such as 5.0.x, 4.1.x, and 3.2.x, may also be susceptible, although they were not actively evaluated for this issue. Django acknowledges Seokchan Yoon for reporting this vulnerability.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Django 6.0 < 6.0.3
Django 5.2 < 5.2.12
Django 4.2 < 4.2.29
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved