SECUFOCUSNOW
Home›CVE index›CVE-2026-25673
Review reviewHigh

CVE-2026-25673

djangoproject Django, Red Hat Ansible Automation Platform 2, Red Hat Discovery 2

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial of service via large URL inputs containing these characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

CVSS
7.5
EPSS
0.73%
50.9% percentile
CISA KEV
Not listed
Published
2026.03.04
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.73%
Technical severityCVSS 7.5

Vulnerability overview

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial of service via large URL inputs containing these characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

Affected product and versions

Product
djangoproject Django, Red Hat Ansible Automation Platform 2, Red Hat Discovery 2
Affected versions
>= 6.0 < 6.0.3, >= 5.2 < 5.2.12, >= 4.2 < 4.2.29, >= 4.2.0 < 4.2.29
Fixed versions
4.2.29, 5.2.12, 6.0.3

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that djangoproject Django, Red Hat Ansible Automation Platform 2, Red Hat Discovery 2 and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
CWE-400, CWE-770
CVE-2026-25673 — djangoproject Django, Red Hat Ansible Automation Platform 2, Red Hat Discovery 2 | SECUFOCUS NOW