Not rated
CVE-2026-25673 An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29
Description
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial of service via large URL inputs containing these characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Discovery 2 | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Django 6.0 | 6.0 → < 6.0.3 | 6.0.3 |
| Django 5.2 | 5.2 → < 5.2.12 | 5.2.12 |
| Django 4.2 | 4.2 → < 4.2.29 | 4.2.29 |
References
- Django security archive docs.djangoproject.com
- Django releases announcements groups.google.com
- Django security releases issued: 6.0.3, 5.2.12, and 4.2.29 www.djangoproject.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Ansible Automation Platform 2
The 210 CVEs of Red Hat Ansible Automation Platform 2 →
CVE-2026-114236
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a…
3.3
Low
CVE-2026-109131
Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)
5.4
Medium
CVE-2026-92982
A flaw was found in Ansible Operator Plugins
8.5
High
CVE-2026-89091
Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
8.8
High