... n 4.2.28. CVE-2026-25673: Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows ¶ The URLField form field's to_python() method used urlsplit() to determine whether t ... split() performs NFKC normalization , which can be disproportionately slow for large inputs containing certain characters. URLField.to_python() now uses a simplified scheme detection, avoiding Unicode normalization entirely and deferring URL validation t ... pped by default, characters such as newlines, tabs, and other control characters within the value are no longer handled by URLField.to_python() . When using the default URLValidator , these values will continue to raise ValidationError during validation, ... ... 11. It also fixes one bug related to support for Python 3.14. CVE-2026-25673: Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows ¶ The URLField form field's to_python() method used urlsplit() to determine whether t ... split() performs NFKC normalization , which can be disproportionately slow for large inputs containing certain characters. URLField.to_python() now uses a simplified scheme detection, avoiding Unicode normalization entirely and deferring URL validation t ... pped by default, characters such as newlines, tabs, and other control characters within the value are no longer handled by URLField.to_python() . When using the default URLValidator , these values will continue to raise ValidationError during validation, ... ... n 4.2.28. CVE-2026-25673: Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows ¶ The URLField form field's to_python() method used urlsplit() to determine whether t ... split() performs NFKC normalization , which can be disproportionately slow for large inputs containing certain characters. URLField.to_python() now uses a simplified scheme detection, avoiding Unicode normalization entirely and deferring URL validation t ... pped by default, characters such as newlines, tabs, and other control characters within the value are no longer handled by URLField.to_python() . When using the default URLValidator , these values will continue to raise ValidationError during validation, ... ... 11. It also fixes one bug related to support for Python 3.14. CVE-2026-25673: Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows ¶ The URLField form field's to_python() method used urlsplit() to determine whether t ... split() performs NFKC normalization , which can be disproportionately slow for large inputs containing certain characters. URLField.to_python() now uses a simplified scheme detection, avoiding Unicode normalization entirely and deferring URL validation t ... pped by default, characters such as newlines, tabs, and other control characters within the value are no longer handled by URLField.to_python() . When using the default URLValidator , these values will continue to raise ValidationError during validation, ... ... everal bugs in 6.0.2. CVE-2026-25673: Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows ¶ The URLField form field's to_python() method used urlsplit() to determine whether t ... split() performs NFKC normalization , which can be disproportionately slow for large inputs containing certain characters. URLField.to_python() now uses a simplified scheme detection, avoiding Unicode normalization entirely and deferring URL validation t ... pped by default, characters such as newlines, tabs, and other control characters within the value are no longer handled by URLField.to_python() . When using the default URLValidator , these values will continue to raise ValidationError during validation, ... ... everal bugs in 6.0.2. CVE-2026-25673: Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows ¶ The URLField form field's to_python() method used urlsplit() to determine whether t ... split() performs NFKC normalization , which can be disproportionately slow for large inputs containing certain characters. URLField.to_python() now uses a simplified scheme detection, avoiding Unicode normalization entirely and deferring URL validation t ... pped by default, characters such as newlines, tabs, and other control characters within the value are no longer handled by URLField.to_python() . When using the default URLValidator , these values will continue to raise ValidationError during validation, ... ... issue has severity "moderate" according to the Django security policy . CVE-2026-15920: Potential cross-site scripting via URLField values in the admin ¶ The admin renders URLField values as clickable links on changelist views and read-only fields. The l ... without validating the value as a safe URL, so a stored value using a potentially dangerous scheme was rendered as a link. URLField values shown via display_for_field are now validated using URLValidator before a link is rendered, and displayed as plain ... tential denial-of-service vulnerability via nested geometry collections CVE-2026-15920: Potential cross-site scripting via URLField values in the admin 前のトピックへ Django 5.2.18 release notes 次のトピックへ Django 5.2.16 release notes 関連キーワード i ... ... issue has severity "moderate" according to the Django security policy . CVE-2026-15920: Potential cross-site scripting via URLField values in the admin ¶ The admin renders URLField values as clickable links on changelist views and read-only fields. The l ... without validating the value as a safe URL, so a stored value using a potentially dangerous scheme was rendered as a link. URLField values shown via display_for_field are now validated using URLValidator before a link is rendered, and displayed as plain ... tential denial-of-service vulnerability via nested geometry collections CVE-2026-15920: Potential cross-site scripting via URLField values in the admin 前のトピックへ Django 5.2.18 release notes 次のトピックへ Django 5.2.16 release notes 関連キーワード D ... ... issue has severity "moderate" according to the Django security policy . CVE-2026-15920: Potential cross-site scripting via URLField values in the admin ¶ The admin renders URLField values as clickable links on changelist views and read-only fields. The l ... without validating the value as a safe URL, so a stored value using a potentially dangerous scheme was rendered as a link. URLField values shown via display_for_field are now validated using URLValidator before a link is rendered, and displayed as plain ... tential denial-of-service vulnerability via nested geometry collections CVE-2026-15920: Potential cross-site scripting via URLField values in the admin バグ修正 前のトピックへ Django 6.0.9 release notes 次のトピックへ Django 6.0.7 release notes 関連キーワ ... ... issue has severity "moderate" according to the Django security policy . CVE-2026-15920: Potential cross-site scripting via URLField values in the admin ¶ The admin renders URLField values as clickable links on changelist views and read-only fields. The l ... without validating the value as a safe URL, so a stored value using a potentially dangerous scheme was rendered as a link. URLField values shown via display_for_field are now validated using URLValidator before a link is rendered, and displayed as plain ... tential denial-of-service vulnerability via nested geometry collections CVE-2026-15920: Potential cross-site scripting via URLField values in the admin バグ修正 前のトピックへ Django 6.0.9 release notes 次のトピックへ Django 6.0.7 release notes 関連キーワ ... 2026年10月08日