admin-auth0 (>=0.1.1, <=0.1.5), alcali (3006.3.0) +150 more potentially affected by CVE-2026-25673 via django (>=4.2.0, <=4.2.28)

django PYPI version =4.2.0, =0.1.1, =4.2.6.0, =65.10.0, =7.5.0a0, =1.1.0a0, =1.0.2, =0.0.1, =1.3.9, =0.4.0, =0.0.1, =4.16.2, =4.17.1 and more Source cves: CVE-2026-25673 Source advisory: OSV:PYSEC-2026-2448...

arthexis (>=0.1.3, <=0.2.3), cdm-ecommerce-backend (0.1.0) +67 more potentially affected by CVE-2026-25673 via django (>=5.2.0, <=5.2.11)

django PYPI version =5.2.0, =0.1.3, =8.6.0, =0.32.0, =8.9.21, =0.1.0, =0.1.0, =1.3.0, =0.1.0, =2025.7.0, =2025.7.38 - django-factory-all 0.1.2 and more Source cves: CVE-2026-25673 Source advisory: OSV:PYSEC-2026-2448...

bravoserver (3.1.0), creadoc (0.0.10) +21 more potentially affected by CVE-2026-25673 via django (>=6.0.0, <=6.0.2)

django PYPI version =6.0.0, =2.0.0, =1.1.0, =0.1.0b2, =0.1.2, =0.20.4, =0.22.1 - docker-compose-control-center 5.0.0 and more Source cves: CVE-2026-25673 Source advisory: OSV:PYSEC-2026-2448...

SUSE CVE-2026-25673

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. URLField.topython in Django calls urllib.parse.urlsplit, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial o...

arthexis (>=0.1.3, <=0.2.3), cdm-ecommerce-backend (0.1.0) +70 more potentially affected by CVE-2026-25673 via django (>=5.2.0a1, <=5.2.11)

django PYPI version =5.2.0a1, =0.1.3, =8.6.0, =0.32.0, =8.9.21, =0.1.0, =0.1.0, =1.3.0, =0.1.0, =2025.7.0, =2025.7.38 - django-factory-all 0.1.2 and more Source cves: CVE-2026-25673 Source advisory: SNYK:PYTHON-DJANGO-15371389...

arches (8.0.0a1), bravoserver (3.1.0) +29 more potentially affected by CVE-2026-25673 via django (>=6.0.0a1, <=6.0.2)

django PYPI version =6.0.0a1, =2.0.0, =1.1.0, =0.1.0, =0.4.5 - django-sb-simple-migrations 0.9.0 - django-tasks-aws 0.2.0b1 and more Source cves: CVE-2026-25673 Source advisory: SNYK:PYTHON-DJANGO-15371389...

CVE-2026-25673

creationtimestamp| type| source ---|---|--- 2026-03-03 15:52:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg64sxpox22y 2026-03-03 16:20:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg66ev2kou2n 2026-03-03 17:52:57+00:00| seen|...

arthexis (>=0.1.3, <=0.2.3), cdm-ecommerce-backend (0.1.0) +67 more potentially affected by CVE-2026-25673 via django (>=5.2.0, <=5.2.11)

django PYPI version =5.2.0, =0.1.3, =8.6.0, =0.32.0, =8.9.21, =0.1.0, =0.1.0, =1.3.0, =0.1.0, =2025.7.0, =2025.7.38 - django-factory-all 0.1.2 and more Source cves: CVE-2026-25673 Source advisory: OSV:GHSA-8P8V-WH79-9R56...

CVE-2026-25673

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. URLField.topython in Django calls urllib.parse.urlsplit, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial o...

CVE-2026-25673

The Django web framework is vulnerable to a denial-of-service (DoS) attack due to uncontrolled resource consumption in the URLField.to_python() function. This issue occurs because the function calls urllib.parse.urlsplit(), which performs NFKC normalization on Windows that is disproportionately s...

admin-auth0 (>=0.1.1, <=0.1.5), alcali (3006.3.0) +150 more potentially affected by CVE-2026-25673 via django (>=4.2.0, <=4.2.28)

django PYPI version =4.2.0, =0.1.1, =4.2.6.0, =65.10.0, =7.5.0a0, =1.1.0a0, =1.0.2, =0.0.1, =1.3.9, =0.4.0, =0.0.1, =4.16.2, =4.17.1 and more Source cves: CVE-2026-25673 Source advisory: MEND:CVE-2026-25673...

arthexis (>=0.1.3, <=0.2.3), cdm-ecommerce-backend (0.1.0) +67 more potentially affected by CVE-2026-25673 via django (>=5.2.0, <=5.2.11)

django PYPI version =5.2.0, =0.1.3, =8.6.0, =0.32.0, =8.9.21, =0.1.0, =0.1.0, =1.3.0, =0.1.0, =2025.7.0, =2025.7.38 - django-factory-all 0.1.2 and more Source cves: CVE-2026-25673 Source advisory: MEND:CVE-2026-25673...

CVE-2026-25673

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. URLField.topython in Django calls urllib.parse.urlsplit, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial o...