Vulnerability Directory | CVE-2026-25673

Overview

Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides built-in components for handling common web development tasks such as authentication, database interaction, and request routing.

‍

A denial-of-service vulnerability (CVE-2026-25673) has been identified in Django, where the URLField.to_python() method could be exploited through specially crafted large inputs containing certain Unicode characters. This issue stems from Django’s use of Python’s urlsplit() function for URL scheme detection, which performs expensive Unicode NFKC normalization on Windows platforms. This improper handling of maliciously crafted input may allow attackers to trigger disproportionate processing overhead, potentially resulting in excessive resource consumption and service degradation within affected Django applications.

‍

Per OWASP: Denial-of-Service (DoS) vulnerabilities occur when an application can be forced to consume excessive resources, preventing legitimate users from accessing the service. Resource exhaustion attacks commonly target memory, CPU, storage, or network bandwidth by exploiting weaknesses in how applications process untrusted input.

‍

Details

Module Info

Product: Django
Affected packages: django
Affected versions: <=3.2.25, <=4.2.28, <=5.2.11, <=6.0.2
GitHub repository: https://github.com/django/django
Published packages: https://pypi.org/project/Django/
Package manager: pip
Fixed in: Django NES v3.2.27 and v4.2.31

‍

Vulnerability Info

This Medium-severity vulnerability is found in the forms package in all published versions of Django.

Normally, Django’s form handling framework is designed to safely process and normalize user-supplied URL input before performing validation or application logic. In particular, the URLField.to_python() method is intended to efficiently detect and normalize URL schemes without allowing malformed or excessively large input values to negatively impact application performance.

However, due to Django’s reliance on Python’s urlsplit() function for scheme detection, an attacker can submit specially crafted large inputs containing certain Unicode characters that trigger expensive Unicode NFKC normalization on Windows platforms. This behavior may cause disproportionate processing overhead during URL parsing, potentially resulting in excessive CPU consumption and denial-of-service conditions within affected Django applications.

This issue arises from inefficient handling of Unicode normalization during URL scheme detection in Django’s URLField.to_python() implementation, enabling attackers to exploit computationally expensive parsing behavior through specially crafted URL input values.

‍