CVE-2023-46695: Django potential denial of service vulnerability in UsernameField on Windows
Summary
CVE-2023-46695: Django potential denial of service vulnerability in UsernameField on Windows. Affects django across 3 version ranges.
>= 3.2a1, < 3.2.23
>= 4.1a1, < 4.1.13
>= 4.2a1, < 4.2.7
Fixed in 3.2.23, 4.1.13 or 4.2.7, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
The same CVE-2023-46695 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It provides a wide range of features and tools for building secure and scalable websites. The UsernameField is a component in Django's authentication system that handles the validation and processing of username inputs. However, a vulnerability has been discovered in versions 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7, where the NFKC normalization process is slow on Windows. This vulnerability can be exploited to launch a potential denial of service (DoS) attack by sending inputs with a large number of Unicode characters.
Vulnerability Detail
The NFKC normalization process, used by Django's UsernameField, is significantly slower on Windows compared to other platforms. This performance issue can be abused by an attacker to cause a denial of service (DoS) attack. By sending inputs with an excessive number of Unicode characters, the processing time for normalization becomes unreasonably long, leading to resource exhaustion and potential service disruption. This vulnerability poses a moderate risk as it can impact the availability of affected Django applications.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.2a1, < 3.2.233.2.23pip install --upgrade "django==3.2.23" -
>= 4.1a1, < 4.1.134.1.13pip install --upgrade "django==4.1.13" -
>= 4.2a1, < 4.2.74.2.7pip install --upgrade "django==4.2.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can implement input validation to limit the number of Unicode characters accepted by the UsernameField. By setting a reasonable maximum limit for the username length, the impact of the vulnerability can be mitigated. Here's an example of how to enforce a maximum length of 100 characters in Django's forms.py file:
from django import forms
class CustomUserCreationForm(forms.Form):
username = forms.CharField(max_length=100)
...
By restricting the input length, the potential for a DoS attack is reduced.
Conclusion
In conclusion, the NFKC normalization performance issue in Django's UsernameField on Windows can be exploited to launch a denial of service (DoS) attack. It is crucial for Django users to update their installations to the fixed versions (3.2.23, 4.1.13, or 4.2.7) to mitigate this vulnerability. Implementing input validation to limit the number of Unicode characters accepted can also provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
This vulnerability can lead to a denial of service (DoS) attack, potentially causing service disruption and unavailability of the affected Django application.
Versions 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7 are vulnerable to this issue.
Yes, this vulnerability can be exploited remotely by sending malicious inputs to the affected Django application.
The recommended mitigation is to upgrade Django to the fixed versions (3.2.23, 4.1.13, or 4.2.7). Additionally, implementing input validation to limit the number of Unicode characters accepted can help mitigate the impact.
Yes, developers can enforce a maximum length for the username input field to reduce the impact of the vulnerability. This can be done by setting the 'max_length' attribute in Django's forms.py file.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
