There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.
    `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on
    Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to
    cause denial of service via large URL inputs containing these characters. Earlier, unsupported Django
    series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to
    thank Seokchan Yoon for reporting this issue. (CVE-2026-25673)

  - An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in
    file-system storage and file-based cache backends in Django allows an attacker to cause file system
    objects to be created with incorrect permissions via concurrent requests, where one thread's temporary
    `umask` change affects other threads in multi-threaded environments. Earlier, unsupported Django series
    (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank
    Tarek Nakkouch for reporting this issue. (CVE-2026-25674)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.
    `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on
    Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to
    cause denial of service via large URL inputs containing these characters. Earlier, unsupported Django
    series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to
    thank Seokchan Yoon for reporting this issue. (CVE-2026-25673)

检测到的 Django Python 程序包版本为低于 4.2.29的 4.2.x 、低于 5.2.12的 5.2.x 或低于 [ 6.0.x 的 6.0.3。因而受到一个拒绝服务漏洞的影响如 安全公告所述

  - 在低于 6.0.3[] 的  6.0 、低于 5.2.12的 5.2 和低于 4.2 的 4.2.29中发现问题。 Django 中的“URLField.to_python()”调用“urllib.parse.urlsplit()”而“urllib.parse.urlsplit()”会在 Windows 上执行 NFKC 规范化其对于某些 Unicode 字符而言异常缓慢从而允许远程攻击者通过包含这些字符的大型 URL 输入造成拒绝服务个字符。此前不受支持的 Django 系列如 5.0.x、 4.1.x和 3.2.x] 未得到评估因此也可能受到影响。 (CVE-2026-25673)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

偵測到的 Django Python 套件版本是比 4.2.294.2.x ] 舊的  、比 5.2.x 舊的 5.2.12或比 6.0.x 舊的 6.0.3。因此會受到安全性版本公告所提及的一個拒絕服務弱點影響

  - 在 6.0 之前的 6.0.3、 5.2 之前的 5.2.12和 4.2 之前的 4.2.29中發現一個問題。 Django 中的「URLField.to_python()」呼叫「urllib.parse.urlsplit()」而後者會在速度慢得不成比例的 Windows 上執行 NFKC 標準化作業進而讓遠端攻擊者透過含有這些字元的大型 URL 輸入個字元。之前未評估不受支援的 Django 系列 (例如 5.0.x、 4.1.x和 3.2.x)因此也可能受到影響。 (CVE-2026-25673)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Django Python パッケージの検出されたバージョンは、 4.2.29より前の 4.2.x 、 5.2.x より前の 5.2.12]、または 6.0.x より前の 6.0.3です。したがって、セキュリティリリースアドバイザリに記載されているとおり、サービス拒否の脆弱性の影響を受けます

  - より前の 6.0.36.0 、 5.2 より前の 5.2.12]、 4.2 より前の 4.2.29で問題が発見されました。 Django の「URLField.to_python()」は、「urllib.parse.urlsplit()」を呼び出し、特定の Unicode 文字に対して不均衡に遅い Windows で NFKC正規化を実行します。これにより、リモートの攻撃者が、これらの問題を含む大きな URL 入力を介して、サービス拒否を引き起こすことができます。可能性があります。以前には、サポートされていない Django シリーズ 5.0.x、 4.1.x、 3.2.xなどは評価されず、また影響を受ける可能性があります。CVE-2026-25673

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The detected version of the Django Python package, is 4.2.x prior to 4.2.29, 5.2.x prior to 5.2.12, or 6.0.x prior to 6.0.3. It is, therefore, affected by a denial of service vulnerability as referenced by security release advisory:

  - An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.     `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on     Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to     cause denial of service via large URL inputs containing these characters. Earlier, unsupported Django     series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. (CVE-2026-25673)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
438419	Alpine: multiple py3-django packages: security update to 4.2.29-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/3/6	2026/7/2	low
438355	SCA: security update for Django (GHSA-8p8v-wh79-9r56)	Tenable Cloud Security	SCA Checks	2026/3/5	2026/7/2	high
438419	Alpine: multiple py3-django packages: security update to 4.2.29-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/3/6	2026/7/2	low
438355	SCA: security update for Django (GHSA-8p8v-wh79-9r56)	Tenable Self-Hosted Container Security	SCA Checks	2026/3/5	2026/7/2	high
300915	Python 库 Django 4.2.x < 4.2.29 / 5.2.x < 5.2.12 / 6.0.x < 6.0.3 DoS	Nessus	Windows	2026/3/5	2026/4/30	high
300915	Python 程式庫 Django 4.2.x < 4.2.29 / 5.2.x < 5.2.12 / 6.0.x < 6.0.3 DoS	Nessus	Windows	2026/3/5	2026/4/30	high
300915	Python ライブラリ Django 4.2.x < 4.2.29 / 5.2.x < 5.2.12 / 6.0.x < 6.0.3 DoS	Nessus	Windows	2026/3/5	2026/4/30	high
300915	Python Library Django 4.2.x < 4.2.29 / 5.2.x < 5.2.12 / 6.0.x < 6.0.3 DoS	Nessus	Windows	2026/3/5	2026/4/30	high

检测

插件搜索

low

high

low

high

high

high

high

high