Posted by Natalia Bidart on March 3, 2026

Django's platform provides a  framework for building web applications with Python, offering documentation, tutorials, and community resources for developers. With its batteries-included philosophy and robust features for rapid development, Django empowers developers to create secure, scalable, and maintainable web applications with ease.

Django

Django has issued security releases for versions 6.0.3, 5.2.12, and 4.2.29, addressing two CVEs. CVE-2026-25673 fixes a potential denial-of-service vulnerability in URLField caused by slow Unicode (NFKC) normalization on Windows via urllib.parse.urlsplit(); the fix avoids normalization entirely in to_python(). CVE-2026-25674 addresses a race condition in multi-threaded environments where temporary umask changes could cause file system objects to be created with unintended permissions; Django now uses os.chmod() after os.mkdir() instead of relying on umask. All users are urged to upgrade immediately.

Django security releases issued: 6.0.3, 5.2.12, and 4.2.29

CVE-2026-25673: Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows