CVE-2023-46695
Django potential denial of service vulnerability in UsernameField on Windows
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
- Record
CVE-2023-46695- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
- Record
CVE-2023-46695- Updated
- 2026-11-02
EUVDEUVD-2023-0068 No score
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
- Record
EUVD-2023-0068- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qmf9-6jqf-j8fq
Django potential denial of service vulnerability in UsernameField on Windows
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
- Record
GHSA-qmf9-6jqf-j8fq- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
OSVGHSA-qmf9-6jqf-j8fq
Django potential denial of service vulnerability in UsernameField on Windows
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
- Record
GHSA-qmf9-6jqf-j8fq- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
OSVOESA-2023-1846
python-django security update
Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.
Security Fix(es):
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.(CVE-2023-46695)
- Record
OESA-2023-1846- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVBIT-django-2023-46695 No score
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
- Record
BIT-django-2023-46695- Updated
- 2026-11-02
OSVCLSA-2026-1788170175 No score
TuxCare security update for django (2 CVEs)
TuxCare rebuilt django to address 2 CVEs. Fixed in 4.0.post15+tuxcare.
- Record
CLSA-2026-1788170175- Updated
- 2026-11-02
OSVCLSA-2026-1792393048 No score
TuxCare security update for django (20 CVEs)
TuxCare rebuilt django to address 20 CVEs. Fixed in 4.2.post17+tuxcare.
- Record
CLSA-2026-1792393048- Updated
- 2026-11-02
OSV No score
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
- Record
CVE-2023-46695- Updated
- 2026-11-02
OSVPYSEC-2023-222 No score
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
- Record
PYSEC-2023-222- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
3.2a1 up to 3.2.23 | 3.2.23 |
djangoPyPI |
4.1a1 up to 4.1.13 | 4.1.13 |
djangoPyPI |
4.2a1 up to 4.2.7 | 4.2.7 |
djangoBitnami |
3.2.0 up to 3.2.23, 4.1.0 up to 4.1.13, 4.2.0 up to 4.2.7 | 3.2.234.1.134.2.7 |
djangoTuxCare:PyPI From an advisory covering 2 CVEs |
4.0 up to 4.0.post15+tuxcare, plus listed versions 4.0.post1+tuxcare4.0.post10+tuxcare4.0.post11+tuxcare4.0.post12+tuxcare4.0.post13+tuxcare Show 9 moreShow less4.0.post14+tuxcare4.0.post2+tuxcare4.0.post3+tuxcare4.0.post4+tuxcare4.0.post5+tuxcare4.0.post6+tuxcare4.0.post7+tuxcare4.0.post8+tuxcare4.0.post9+tuxcare |
4.0.post15+tuxcare |
djangoTuxCare:PyPI From an advisory covering 20 CVEs |
4.2 up to 4.2.post17+tuxcare, plus listed versions 4.2.post1+tuxcare4.2.post10+tuxcare4.2.post11+tuxcare4.2.post12+tuxcare4.2.post13+tuxcare Show 11 moreShow less4.2.post14+tuxcare4.2.post15+tuxcare4.2.post16+tuxcare4.2.post2+tuxcare4.2.post3+tuxcare4.2.post4+tuxcare4.2.post5+tuxcare4.2.post6+tuxcare4.2.post7+tuxcare4.2.post8+tuxcare4.2.post9+tuxcare |
4.2.post17+tuxcare |
djangoPyPI |
3.2a1 up to 3.2.23, plus listed versions 3.23.2.13.2.103.2.113.2.12 Show 20 moreShow less3.2.133.2.143.2.153.2.163.2.173.2.183.2.193.2.23.2.203.2.213.2.223.2.33.2.43.2.53.2.63.2.73.2.83.2.93.2b13.2rc1 |
3.2.23 |
djangoPyPI |
4.1a1 up to 4.1.13, plus listed versions 4.14.1.14.1.104.1.114.1.12 Show 10 moreShow less4.1.24.1.34.1.44.1.54.1.64.1.74.1.84.1.94.1b14.1rc1 |
4.1.13 |
djangoPyPI |
4.2a1 up to 4.2.7, plus listed versions 4.24.2.14.2.24.2.34.2.4 Show 4 moreShow less4.2.54.2.64.2b14.2rc1 |
4.2.7 |
python-djangoopenEuler:20.03-LTS-SP1 |
before 2.2.27-9.oe1 | 2.2.27-9.oe1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-djangoopenEuler:20.03-LTS-SP3 |
before 2.2.27-9.oe1 | 2.2.27-9.oe1 |
python-djangoopenEuler:22.03-LTS |
before 3.2.12-8.oe2203sp2 | 3.2.12-8.oe2203sp2 |
python-djangoopenEuler:22.03-LTS-SP1 |
before 3.2.12-8.oe2203sp1 | 3.2.12-8.oe2203sp1 |
python-djangoopenEuler:22.03-LTS-SP2 |
before 3.2.12-8.oe2203sp2 | 3.2.12-8.oe2203sp2 |
djangoPyPI |
3.2 up to 3.2.23, 4.1 up to 4.1.13, 4.2 up to 4.2.7, plus listed versions 3.2.13.2.103.2.113.2.123.2.13 Show 35 moreShow less3.2.143.2.153.2.163.2.173.2.183.2.193.2.23.2.203.2.213.2.223.2.33.2.43.2.53.2.63.2.73.2.83.2.94.1.14.1.104.1.114.1.124.1.24.1.34.1.44.1.54.1.64.1.74.1.84.1.94.2.14.2.24.2.34.2.44.2.54.2.6 |
3.2.234.1.134.2.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-46695 is a high vulnerability (CVSS 7.5) in Djangoproject Django, published November 2, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 53.4%, the 98th percentile. Fixed in django 3.2.23.
References
groups.google.com/forum
docs.djangoproject.com/en/4.2/releases/security
djangoproject.com/weblog/2023/nov/01/security-releases
security.netapp.com/advisory/ntap-20231214-0001
nvd.nist.gov/vuln/detail/CVE-2023-46695
github.com/django/django/commit/048a9ebb6ea468426cb4e57c71572cbbd975517f
Show 7 moreShow less
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1846