CVE-2026-25673: Potential denial-of-service vulnerability in ``URLField`` via Unicode normalization on Windows

==============================================================================================================

The :class:`~django.forms.URLField` form field's ``to_python()`` method used

:func:`~urllib.parse.urlsplit` to determine whether to prepend a URL scheme to

the submitted value. On Windows, ``urlsplit()`` performs

:func:`NFKC normalization <python:unicodedata.normalize>`, which can be

disproportionately slow for large inputs containing certain characters.

``URLField.to_python()`` now uses a simplified scheme detection, avoiding

Unicode normalization entirely and deferring URL validation to the appropriate

layers. As a result, while leading and trailing whitespace is still stripped by

default, characters such as newlines, tabs, and other control characters within

the value are no longer handled by ``URLField.to_python()``. When using the

default :class:`~django.core.validators.URLValidator`, these values will

continue to raise :exc:`~django.core.exceptions.ValidationError` during

validation, but if you rely on custom validators, ensure they do not depend on

the previous behavior of ``URLField.to_python()``.

This issue has severity "moderate" according to the :ref:`Django security

policy <security-disclosure>`.

CVE-2026-25673: Potential denial-of-service vulnerability in ``URLField`` via Unicode normalization on Windows

==============================================================================================================

The :class:`~django.forms.URLField` form field's ``to_python()`` method used

:func:`~urllib.parse.urlsplit` to determine whether to prepend a URL scheme to

the submitted value. On Windows, ``urlsplit()`` performs

:func:`NFKC normalization <python:unicodedata.normalize>`, which can be

disproportionately slow for large inputs containing certain characters.

``URLField.to_python()`` now uses a simplified scheme detection, avoiding

Unicode normalization entirely and deferring URL validation to the appropriate

layers. As a result, while leading and trailing whitespace is still stripped by

default, characters such as newlines, tabs, and other control characters within

the value are no longer handled by ``URLField.to_python()``. When using the

default :class:`~django.core.validators.URLValidator`, these values will

continue to raise :exc:`~django.core.exceptions.ValidationError` during

validation, but if you rely on custom validators, ensure they do not depend on

the previous behavior of ``URLField.to_python()``.

This issue has severity "moderate" according to the :ref:`Django security

policy <security-disclosure>`.

CVE-2026-25673: Potential denial-of-service vulnerability in ``URLField`` via Unicode normalization on Windows

==============================================================================================================

The :class:`~django.forms.URLField` form field's ``to_python()`` method used

:func:`~urllib.parse.urlsplit` to determine whether to prepend a URL scheme to

the submitted value. On Windows, ``urlsplit()`` performs

:func:`NFKC normalization <python:unicodedata.normalize>`, which can be

disproportionately slow for large inputs containing certain characters.

``URLField.to_python()`` now uses a simplified scheme detection, avoiding

Unicode normalization entirely and deferring URL validation to the appropriate

layers. As a result, while leading and trailing whitespace is still stripped by

default, characters such as newlines, tabs, and other control characters within

the value are no longer handled by ``URLField.to_python()``. When using the

default :class:`~django.core.validators.URLValidator`, these values will

continue to raise :exc:`~django.core.exceptions.ValidationError` during

validation, but if you rely on custom validators, ensure they do not depend on

the previous behavior of ``URLField.to_python()``.

This issue has severity "moderate" according to the :ref:`Django security

policy <security-disclosure>`.

from django.core.validators import URLValidator

# IPv6 without scheme.

("[12:34::3a53]/", "https://[12:34::3a53]/"),

# IDN domain without scheme but with port.

("ñandú.es:8080/", "https://ñandú.es:8080/"),

# Scheme-relative.

("//example.com", "https://example.com"),

("//example.com/path", "https://example.com/path"),

# Whitespace stripped.

("\t\n//example.com \n\t\n", "https://example.com"),

("\t\nhttp://example.com \n\t\n", "http://example.com"),

# Scheme prepend yields a structurally invalid URL.

# Scheme prepend yields an empty hostname.

# Known problematic unicode chars.

"http://" + "¾" * 200,

# Non-ASCII character before the first colon.

"¾:example.com",

# ASCII digit before the first colon.

"1http://example.com",

# Empty scheme.

"://example.com",

":example.com",

def test_urlfield_assume_scheme_when_colons(self):

f = URLField()

tests = [

# Port number.

("http://example.com:8080/", "http://example.com:8080/"),

("https://example.com:443/path", "https://example.com:443/path"),

# Userinfo with password.

("http://user:pass@example.com", "http://user:pass@example.com"),

(

"http://user:pass@example.com:8080/",

"http://user:pass@example.com:8080/",

),

# Colon in path segment.

("http://example.com/path:segment", "http://example.com/path:segment"),

("http://example.com/a:b/c:d", "http://example.com/a:b/c:d"),

# Colon in query string.

("http://example.com/?key=val:ue", "http://example.com/?key=val:ue"),

# Colon in fragment.

("http://example.com/#section:1", "http://example.com/#section:1"),

# IPv6 -- multiple colons in host.

("http://[::1]/", "http://[::1]/"),

("http://[2001:db8::1]/", "http://[2001:db8::1]/"),

("http://[2001:db8::1]:8080/", "http://[2001:db8::1]:8080/"),

# Colons across multiple components.

(

"http://user:pass@example.com:8080/path:x?q=a:b#id:1",

"http://user:pass@example.com:8080/path:x?q=a:b#id:1",

),

# FTP with port and userinfo.

(

"ftp://user:pass@ftp.example.com:21/file",

"ftp://user:pass@ftp.example.com:21/file",

),

(

"ftps://user:pass@ftp.example.com:990/",

"ftps://user:pass@ftp.example.com:990/",

),

# Scheme-relative URLs, starts with "//".

("//example.com:8080/path", "https://example.com:8080/path"),

("//user:pass@example.com/", "https://user:pass@example.com/"),

]

for value, expected in tests:

with self.subTest(value=value):

self.assertEqual(f.clean(value), expected)

def test_custom_validator_longer_max_length(self):

class CustomLongURLValidator(URLValidator):

max_length = 4096

class CustomURLField(URLField):

default_validators = [CustomLongURLValidator()]

field = CustomURLField()

# A URL with 4096 chars is valid given the custom validator.

prefix = "https://example.com/"

url = prefix + "a" * (4096 - len(prefix))

self.assertEqual(len(url), 4096)

# No ValidationError is raised.

field.clean(url)