Django NFKC Normalization Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Django's response redirection classes on Windows. This issue arises from the NFKC normalization process in Python, which is slow when handling certain inputs with a high volume of Unicode characters. As a result, the classes 'HttpResponseRedirect', 'HttpResponsePermanentRedirect', and the shortcut 'redirect' can be exploited to cause a denial-of-service condition. This vulnerability affects Django versions 5.1 prior to 5.1.14, 4.2 prior to 4.2.26, and 5.2 prior to 5.2.8. Additionally, earlier unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x may also be affected.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, causing the application to become unresponsive or slow.

Remediation

Users can upgrade to Django versions 5.2.8, 5.1.14, or 4.2.26 to address this vulnerability.