CVE-2026-25673: 
Django vulnerability analysis and mitigation

CVE-2026-25673 is a denial-of-service vulnerability in Django's URLField.to_python() method, caused by inefficient NFKC Unicode normalization on Windows systems. It affects Django 4.2 before 4.2.29, 5.2 before 5.2.12, and 6.0 before 6.0.3; earlier unsupported series (5.0.x, 4.1.x, 3.2.x) may also be affected. The vulnerability was reported by Seokchan Yoon and disclosed on March 3, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (Django Security Releases, Oracle Advisory).

The root cause is uncontrolled resource consumption (CWE-400) and allocation of resources without limits or throttling (CWE-770). When URLField.to_python() processes a URL input, it calls urllib.parse.urlsplit(), which on Windows performs NFKC normalization — a Unicode canonicalization process that is disproportionately slow for certain Unicode characters. An unauthenticated remote attacker can submit large URL inputs containing these specific characters, causing excessive CPU consumption and effectively exhausting server resources. No authentication or special privileges are required, and no user interaction is needed to trigger the condition (Django Security Releases, Django Changeset).

Successful exploitation causes denial of service by exhausting CPU resources on affected Django servers running on Windows, rendering the application unresponsive or unavailable to legitimate users. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. The attack can be triggered remotely without authentication, making it accessible to any network-reachable attacker. Third-party products incorporating Django, including Oracle Solaris 11.4 and IBM EDB PGAI Hybrid Management, are also affected (Oracle Advisory, IBM Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.00158 (low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication, no user interaction, and has low attack complexity, making it straightforward to attempt if a PoC were to emerge (Django Security Releases).

1. Reconnaissance: Identify Django-based web applications running on Windows servers, particularly those with form fields or API endpoints that accept URL inputs (e.g., forms using URLField).
2. Identify target endpoint: Locate any publicly accessible endpoint that processes URL input through Django's URLField, such as user profile forms, link submission pages, or REST API endpoints accepting URL parameters.
3. Craft malicious payload: Construct a large URL string containing Unicode characters that trigger slow NFKC normalization in urllib.parse.urlsplit() on Windows (e.g., characters in certain Unicode compatibility equivalence ranges).
4. Send repeated requests: Submit multiple concurrent HTTP requests containing the crafted URL payload to the target endpoint, causing the server's CPU to be consumed by the normalization processing.
5. Achieve denial of service: The server's processing capacity is exhausted, causing legitimate requests to time out or fail, effectively taking the application offline (Django Security Releases).

• Network: High volume of HTTP requests to endpoints accepting URL parameters from a single or distributed set of source IPs; requests containing unusually large URL values with non-ASCII Unicode characters.
• Logs: Django application logs showing repeated processing of URLField inputs with large or unusual Unicode content; web server access logs with high request rates to URL-accepting endpoints.
• System: Sustained high CPU utilization on the Django application server process (e.g., python.exe on Windows) without corresponding legitimate traffic spikes; increased response times or timeouts on URL-processing endpoints.
• Process: python.exe process consuming near-100% CPU for extended periods, particularly on Windows hosts running Django applications.

Django has released patched versions: 4.2.29, 5.2.12, and 6.0.3 — upgrading to one of these is the primary recommended remediation (Django Security Releases). As interim mitigations, implement rate limiting and request size restrictions on URL parameters at the web server or load balancer level, and monitor CPU usage for anomalous patterns. Deploying on non-Windows platforms eliminates the NFKC normalization performance issue entirely, as the vulnerability is Windows-specific. Organizations running unsupported Django versions (5.0.x, 4.1.x, 3.2.x) should treat them as potentially vulnerable and prioritize migration to a supported, patched release. Oracle Solaris 11.4 and IBM EDB PGAI users should apply the respective vendor patches (Oracle Advisory, IBM Advisory).

The Django project credited Seokchan Yoon for responsibly reporting the issue and published a security advisory alongside the patch release on March 3, 2026 (Django Security Releases). Security news outlets including SecurityOnline.info covered the release of Django's security patches addressing this DoS and related permission vulnerabilities. Social media activity on Bluesky and Mastodon noted the disclosure, and threat intelligence aggregators such as Hawk-Eye included it in weekly threat landscape digests. Community reaction was generally measured given the Windows-specific scope and absence of known exploitation.