A vulnerability in the Django web framework allows unauthenticated attackers to trigger a denial-of-service condition through specifically crafted Unicode inputs in redirect functions.

This is an algorithmic complexity vulnerability (CWE-407) occurring during NFKC normalization on Windows. Unauthenticated attackers can exploit the slow processing of large Unicode strings in django.http.HttpResponseRedirect, django.http.HttpResponsePermanentRedirect, and django.shortcuts.redirect to exhaust system resources.

Successful exploitation of this vulnerability results in service unavailability, as the application becomes unresponsive while processing the malicious input. Given the CVSS score of 7.5, the impact is significant, particularly for public-facing web applications relying on Django. This disruption can lead to operational downtime, loss of user productivity, and potential reputational damage.

Immediate Action: Update the Django framework to version 5.2.8, 5.1.14, or 4.2.26, as these releases contain the necessary security patches.

Proactive Monitoring: Monitor server CPU and memory usage for sudden, sustained spikes that correlate with high volumes of incoming HTTP requests to redirect-capable endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block requests containing unusually long strings or suspicious Unicode sequences before they reach the Django application layer.

Public Exploit Available: Yes — a public proof-of-concept repository exists on GitHub.

The severity of this denial-of-service vulnerability warrants immediate attention, especially for deployments running on Windows operating systems. IT and security teams should prioritize patching the Django framework to the specified secure versions to eliminate the underlying algorithmic inefficiency. Failure to update leaves the application susceptible to resource exhaustion attacks that can easily be automated by remote, unauthenticated actors.