CVE-2026-25673: Djangoproject Django DoS Vulnerability

CVE-2026-25673 Overview

CVE-2026-25673 is a Denial of Service vulnerability discovered in Django, the popular Python web framework. The vulnerability exists in URLField.to_python(), which calls urllib.parse.urlsplit(). On Windows systems, this function performs NFKC normalization that is disproportionately slow for certain Unicode characters. A remote attacker can exploit this behavior to cause denial of service by submitting large URL inputs containing these specially crafted Unicode characters.

Critical Impact

Remote attackers can cause application-level denial of service on Windows-based Django deployments by submitting maliciously crafted URLs containing specific Unicode characters, potentially rendering web applications unresponsive.

Affected Products

• Django 6.0 before 6.0.3
• Django 5.2 before 5.2.12
• Django 4.2 before 4.2.29

Discovery Timeline

• 2026-03-03 - Django security releases announced via Django Weblog Security Releases
• 2026-03-03 - CVE CVE-2026-25673 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-25673

Vulnerability Analysis

This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw resides in Django's URL validation mechanism, specifically within the URLField.to_python() method. When processing URL inputs, this method invokes Python's urllib.parse.urlsplit() function, which on Windows systems performs NFKC (Normalization Form Compatibility Composition) Unicode normalization.

The NFKC normalization process exhibits algorithmic complexity issues when handling certain Unicode character sequences. Specific characters trigger computationally expensive normalization operations that scale poorly with input size. An attacker can craft URL inputs containing these problematic Unicode characters, causing the normalization routine to consume excessive CPU resources and effectively stall the application.

Earlier, unsupported Django series including 5.0.x, 4.1.x, and 3.2.x were not formally evaluated but may also be vulnerable to this attack pattern.

Root Cause

The root cause is the use of urllib.parse.urlsplit() for URL parsing without adequate safeguards against computationally expensive Unicode normalization operations. The NFKC normalization algorithm implemented on Windows has known performance characteristics where certain Unicode character combinations result in exponential processing time relative to input length. Django's URLField validation did not implement input length restrictions or normalization timeouts to prevent abuse of this behavior.

Attack Vector

The attack can be executed remotely over the network without authentication. An attacker submits HTTP requests containing form data or API payloads with URL fields populated by large strings of carefully selected Unicode characters. When Django processes these inputs through URLField.to_python(), the resulting NFKC normalization operation consumes disproportionate CPU cycles.

The attack characteristics include:

• Network-accessible: Exploitable via standard HTTP requests to any Django application using URLField validation
• No privileges required: Unauthenticated attackers can submit malicious inputs
• No user interaction needed: The vulnerability triggers automatically during input processing
• Windows-specific: The NFKC normalization performance issue is specific to the Windows implementation

The vulnerability mechanism involves submitting specially crafted Unicode strings to URL form fields. When Django validates these inputs, the underlying urllib.parse.urlsplit() function on Windows performs NFKC normalization that exhibits poor algorithmic performance for certain character sequences, leading to CPU exhaustion. For detailed technical information, refer to the Django Security Release Notes.

Detection Methods for CVE-2026-25673

Indicators of Compromise

• Abnormally high CPU utilization on Windows-based Django application servers during URL field processing
• HTTP requests containing unusually large URL parameter values with high Unicode character density
• Application response time degradation correlated with URL field validation operations
• Web server logs showing repeated requests with malformed or unusually long URL inputs

Detection Strategies

• Monitor application performance metrics for CPU spikes during form submission handling
• Implement request payload size monitoring to detect anomalously large URL field inputs
• Deploy web application firewall rules to detect and block requests with excessive Unicode content in URL parameters
• Enable Django debug logging to identify slow request processing in URL validation paths

Monitoring Recommendations

• Configure alerting for sustained high CPU usage on Django application servers
• Implement request timeout monitoring to detect stalled URL validation operations
• Track request processing duration metrics with correlation to URLField validation endpoints
• Monitor for patterns of repeated large payload submissions from single source addresses

How to Mitigate CVE-2026-25673

Immediate Actions Required

• Upgrade Django to patched versions: 6.0.3, 5.2.12, or 4.2.29 depending on your current series
• Implement request size limits at the web server or reverse proxy level to restrict maximum URL parameter lengths
• Consider input validation middleware to reject URLs exceeding reasonable length thresholds before Django processing
• For applications that cannot be immediately upgraded, implement rate limiting on endpoints accepting URL field inputs

Patch Information

Django has released security patches addressing this vulnerability. Organizations should upgrade to the following versions:

For upgrade instructions and additional details, consult the Django Security Release Notes and the Django Weblog Security Releases.

Django credits Seokchan Yoon for responsibly reporting this vulnerability.

Workarounds

• Implement URL input length restrictions at the application level before Django validation
• Deploy web application firewall rules to sanitize or block requests with suspicious Unicode patterns in URL fields
• Configure reverse proxy timeout settings to terminate long-running requests during URL processing
• For Windows deployments, consider custom URL validation that bypasses the problematic urlsplit() normalization path

# Configuration example - Nginx rate limiting and request size restriction
# Add to nginx.conf server block

# Limit request body size to prevent large payload attacks
client_max_body_size 1m;

# Limit URL length
large_client_header_buffers 4 8k;

# Rate limiting zone definition (add to http block)
# limit_req_zone $binary_remote_addr zone=urlfield_limit:10m rate=10r/s;

# Apply rate limiting to form submission endpoints
# location /submit/ {
#     limit_req zone=urlfield_limit burst=20 nodelay;
# }