Django Denial-of-Service Vulnerability in URLField Unicode Normalization

A denial-of-service vulnerability has been identified in Django's URLField component, affecting versions 6.0 prior to 6.0.3, 5.2 prior to 5.2.12, and 4.2 prior to 4.2.29. The issue arises because URLField's to_python() method calls urllib.parse.urlsplit(), which performs NFKC normalization on Windows. This normalization process can be disproportionately slow for certain Unicode characters, allowing remote attackers to cause delays by sending large URLs with these characters. Although earlier, unsupported Django series may also be affected, this vulnerability has been officially recognized and addressed in the latest security releases.

Impact

Exploitation of this vulnerability can lead to significant performance degradation, causing the application to become unresponsive or slow.

Remediation

Users can upgrade to Django versions 6.0.3, 5.2.12, or 4.2.29 to address this vulnerability.