CVE-2023-46695: Djangoproject Django

High severity, CVSS 7.5. EPSS: 49.8% chance of exploitation in the next 30 days.

An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

Affected products

• Djangoproject Django: from 3.2, before 3.2.23 (fixed in 3.2.23); from 4.1, before 4.1.13 (fixed in 4.1.13); from 4.2., before 4.2.7 (fixed in 4.2.7)

Published 2023-11-02. Last modified 2026-06-17.