High 7.5Published Mar 3, 2026

CVE-2026-25673An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.

Updated under an hour ago (2026-10-19 07:00 UTC)

Does this affect you?

It affects djangoproject django. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for djangoproject django

Exploited in the last 30 days

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial of service via large URL inputs containing these characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

CVSS: 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-400, CWE-770
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Jul 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

djangoproject django djangoproject:django	from 4.2.0 before 4.2.29; from 5.2 before 5.2.12; from 6.0 before 6.0.3	NVD

References

https://docs.djangoproject.com/en/dev/releases/security/patch, vendor-advisory
https://groups.google.com/g/django-announcerelease-notes
https://www.djangoproject.com/weblog/2026/mar/03/security-releases/patch, vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-25673
https://bugzilla.redhat.com/show_bug.cgi?id=2444115
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25673.json

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.