Security readout for executives and security teams
Plain-English summary
A remote user may be able to make affected Django applications on Windows spend excessive CPU time processing specially formed large URL values. The impact is availability, not data theft or code execution. Patched Django releases are available for supported branches.
Executive priority
Treat this as a high-priority availability fix for Windows-hosted Django applications with public URL input. It is less urgent for non-Windows deployments, but teams should still verify versions and follow vendor guidance because unsupported branches were not evaluated.
Technical view
Django URLField.to_python() calls urllib.parse.urlsplit(). On Windows, urlsplit() performs NFKC normalization that is disproportionately slow for certain Unicode characters. Large URL inputs containing those characters can trigger denial of service in Django 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.
Likely exposure
Exposure is most likely in Django applications running on Windows that accept untrusted URL input validated through URLField. Public forms, APIs, admin workflows, and integrations that process user-supplied URLs deserve review first. Unsupported Django series were not evaluated and may also be affected.
Exploitation context
The CVE is not listed as KEV in the supplied bundle, and the sources provided do not claim active exploitation. The attack is network-reachable, unauthenticated, low-complexity, and targets availability through expensive input handling rather than confidentiality or integrity.
Researcher notes
Evidence supports a Windows-specific denial-of-service path through URLField.to_python() and urllib.parse.urlsplit() Unicode normalization. Do not assume code execution, data exposure, or active exploitation from the supplied sources. Unsupported Django branches remain an evidence gap.
Mitigation direction
- Upgrade Django 6.0.x to 6.0.3 or later.
- Upgrade Django 5.2.x to 5.2.12 or later.
- Upgrade Django 4.2.x to 4.2.29 or later.
- Move unsupported Django series to a supported patched branch.
- Check Django and OS vendor advisories for branch-specific guidance.
Validation and detection
- Inventory deployed Django versions from dependency manifests and runtime environments.
- Identify Windows-hosted Django services accepting user-supplied URL values.
- Review forms, serializers, models, and APIs using URLField validation.
- Confirm production deployments run patched Django release numbers.
- Track Red Hat or distro status if Django comes from OS packages.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-25673 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineDSF
Initial report received.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineDSF
Vulnerability confirmed.
- Source timelineDSF
Security release issued.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-03-03T15:01:31.969Z: Reported to Red Hat.
- 2026-03-03T14:28:28.601Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- Django security archiveCVE reference, DSF · vendor-advisory
- Django releases announcementsCVE reference, DSF · mailing-list
- Django security releases issued: 6.0.3, 5.2.12, and 4.2.29CVE reference, DSF · vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-25673CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2444115CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25673.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.