PkgSeer

Vulnerability PYSEC-2026-2448

High Risk

3 months ago

Django vulnerable to Uncontrolled Resource Consumption

4.2 - 4.2.28 and 5.2 - 5.2.11 and 6.0 - 6.0.2

Summary

Django vulnerable to Uncontrolled Resource Consumption

Details

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.

URLField.to_python() in Django calls urllib.parse.urlsplit(), which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial of service via large URL inputs containing these characters.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

1.0.1 - 5.2.16 and 6.0a1 - 6.0.7 PYSEC-2026-4035

Django GeoDjango vulnerable to denial of service through deeply nested geometry collections

1.0.1 - 5.2.16 and 6.0a1 - 6.0.7 and 6.1a1 - 6.1 GHSA-q238-5cxm-5c9h

Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

1.0.1 - 5.2.16 and 6.0a1 - 6.0.7 GHSA-wvqv-fj8w-qmhm

No summary available

1.0.1 - 5.2.16 and 6.0 - 6.0.7 PYSEC-2026-3717

Django has a Race Condition vulnerability

4.2 - 4.2.28 and 5.2 - 5.2.11 and 6.0 - 6.0.2 PYSEC-2026-2449

View all vulnerabilities for these packages

Impacted packages

django

Timeline

Published

3 months ago

Fixed (6.0.3)

8 months ago

Fixed (5.2.12)

8 months ago

Fixed (4.2.29)

8 months ago

Last Modified

3 months ago