{"id":"CVE-2023-46695","aliases":["BIT-django-2023-46695","CLSA-2026-1788170175","CLSA-2026-1792393048","EUVD-2023-0068","GHSA-qmf9-6jqf-j8fq","OESA-2023-1846","PYSEC-2023-222"],"status":"published","title":"Django potential denial of service vulnerability in UsernameField on Windows","description":"An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.53447,"percentile":0.98997,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2023-11-02T00:00:00Z","modified":"2026-10-28T02:31:11Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["3.2.23","4.1.13","4.2.7"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"django","fixed_in":["3.2.23","4.1.13","4.2.7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"python-django","fixed_in":["2.2.27-9.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"python-django","fixed_in":["2.2.27-9.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"python-django","fixed_in":["3.2.12-8.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"python-django","fixed_in":["3.2.12-8.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"python-django","fixed_in":["3.2.12-8.oe2203sp2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2a1"},{"fixed":"3.2.23"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1a1"},{"fixed":"4.1.13"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2a1"},{"fixed":"4.2.7"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"django","ranges":[{"type":"SEMVER","events":[{"introduced":"3.2.0"},{"fixed":"3.2.23"},{"introduced":"4.1.0"},{"fixed":"4.1.13"},{"introduced":"4.2.0"},{"fixed":"4.2.7"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"4.0.post15+tuxcare"}]}],"versions":["4.0","4.0.post1+tuxcare","4.0.post10+tuxcare","4.0.post11+tuxcare","4.0.post12+tuxcare","4.0.post13+tuxcare","4.0.post14+tuxcare","4.0.post2+tuxcare","4.0.post3+tuxcare","4.0.post4+tuxcare","4.0.post5+tuxcare","4.0.post6+tuxcare","4.0.post7+tuxcare","4.0.post8+tuxcare","4.0.post9+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.post17+tuxcare"}]}],"versions":["4.2","4.2.post1+tuxcare","4.2.post10+tuxcare","4.2.post11+tuxcare","4.2.post12+tuxcare","4.2.post13+tuxcare","4.2.post14+tuxcare","4.2.post15+tuxcare","4.2.post16+tuxcare","4.2.post2+tuxcare","4.2.post3+tuxcare","4.2.post4+tuxcare","4.2.post5+tuxcare","4.2.post6+tuxcare","4.2.post7+tuxcare","4.2.post8+tuxcare","4.2.post9+tuxcare"],"bundled":20},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2a1"},{"fixed":"3.2.23"}]}],"versions":["3.2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.15","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.20","3.2.21","3.2.22","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.2a1","3.2b1","3.2rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1a1"},{"fixed":"4.1.13"}]}],"versions":["4.1","4.1.1","4.1.10","4.1.11","4.1.12","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9","4.1a1","4.1b1","4.1rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2a1"},{"fixed":"4.2.7"}]}],"versions":["4.2","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2a1","4.2b1","4.2rc1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-9.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-9.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-8.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-8.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-8.oe2203sp2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2"},{"fixed":"3.2.23"},{"introduced":"4.1"},{"fixed":"4.1.13"},{"introduced":"4.2"},{"fixed":"4.2.7"}]}],"versions":["3.2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.15","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.20","3.2.21","3.2.22","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","4.1","4.1.1","4.1.10","4.1.11","4.1.12","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9","4.2","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6"]}],"products":[{"vendor":"djangoproject","product":"django"}],"references":[{"url":"https://groups.google.com/forum/#%21forum/django-announce","tags":["x_transferred","Permissions Required","web"]},{"url":"https://docs.djangoproject.com/en/4.2/releases/security/","tags":["x_transferred","Patch","fix","web"]},{"url":"https://www.djangoproject.com/weblog/2023/nov/01/security-releases/","tags":["x_transferred","Patch","Vendor Advisory","advisory","article"]},{"url":"https://security.netapp.com/advisory/ntap-20231214-0001/","tags":["x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46695","tags":["web","advisory"]},{"url":"https://groups.google.com/forum/#!forum/django-announce","tags":["web"]},{"url":"https://github.com/django/django/commit/048a9ebb6ea468426cb4e57c71572cbbd975517f","tags":["web"]},{"url":"https://github.com/django/django/commit/4965bfdde2e5a5c883685019e57d123a3368a75e","tags":["web"]},{"url":"https://github.com/django/django/commit/f9a7fb8466a7ba4857eaf930099b5258f3eafb2b","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-222.yaml","tags":["web"]},{"url":"https://docs.djangoproject.com/en/4.2/releases/security","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20231214-0001","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2023/nov/01/security-releases","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qmf9-6jqf-j8fq","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46695.json","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1846","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-46695","description":"An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.","status":"published","published":"2023-11-02T00:00:00Z","modified":"2024-08-02T20:53:20.867Z","updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-0068","description":"An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.","status":"published","published":"2023-11-02T00:00:00Z","modified":"2024-08-02T20:53:20Z","updated_at":"2026-11-03T03:49:58.369276Z"}],"ghsa":[{"id":"GHSA-qmf9-6jqf-j8fq","title":"Django potential denial of service vulnerability in UsernameField on Windows","description":"An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.","status":"published","published":"2023-11-02T06:30:25Z","modified":"2024-09-20T16:05:10Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2023-46695","description":"An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.","status":"published","published":"2023-11-02T06:15:08Z","modified":"2026-06-17T06:31:22.76Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:08:41.047232Z"}],"osv":[{"id":"GHSA-qmf9-6jqf-j8fq","title":"Django potential denial of service vulnerability in UsernameField on Windows","description":"An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.","status":"published","published":"2023-11-02T06:30:25Z","modified":"2024-09-20T16:07:45.381236Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"OESA-2023-1846","title":"python-django security update","description":"Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.(CVE-2023-46695)","status":"published","published":"2023-11-17T11:06:17Z","modified":"2026-08-18T01:18:04.156920456Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"BIT-django-2023-46695","description":"An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.","status":"published","published":"2024-03-06T10:51:16.068Z","modified":"2026-09-08T08:46:36.26960784Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"CLSA-2026-1788170175","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 4.0.post15+tuxcare.","status":"published","published":"2026-08-31T09:56:15Z","modified":"2026-10-15T09:48:05.771414051Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1792393048","title":"TuxCare security update for django (20 CVEs)","description":"TuxCare rebuilt django to address 20 CVEs. Fixed in 4.2.post17+tuxcare.","status":"published","published":"2026-10-19T06:57:28Z","modified":"2026-10-19T13:30:08.114607458Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CVE-2023-46695","description":"An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.","status":"published","published":"2023-11-02T00:00:00Z","modified":"2026-10-28T02:31:11.241134581Z","updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"PYSEC-2023-222","description":"An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.","status":"published","published":"2023-11-02T06:15:00Z","modified":"2026-06-10T17:01:02.672946253Z","updated_at":"2026-11-02T15:52:53.837392Z"}]}}