A vulnerability in Django allows unauthenticated remote attackers to trigger a denial of service condition through the submission of specially crafted URL inputs.

The vulnerability exists in the URLField.to_python() method, which utilizes urllib.parse.urlsplit() to perform NFKC normalization. On Windows environments, this normalization process is computationally expensive, enabling an unauthenticated attacker to cause uncontrolled resource consumption via large or complex URL inputs.

Successful exploitation results in a denial of service, effectively rendering the affected Django application unavailable to legitimate users. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to service continuity for organizations relying on Django for web infrastructure, as it requires no authentication or user interaction to execute.

Immediate Action: Update Django to version 6.0.3, 5.2.12, or 4.2.29, depending on your current deployment series.

Proactive Monitoring: Monitor system resource utilization, specifically CPU spikes and memory consumption associated with the web server process, when handling incoming URL-based requests.

Compensating Controls: Implement rate limiting or request size validation at the Web Application Firewall (WAF) or load balancer level to drop oversized or malformed URL inputs before they reach the application layer.

Public Exploit Available: No (exploit_available: unknown)

Organizations running Django on Windows should prioritize applying the provided security updates immediately. While the vulnerability is specific to the Windows platform, the simplicity of the attack vector makes it a priority for remediation to ensure high availability of critical web services.