CVE-2023-46695: Django UsernameField DoS via slow NFKC normalization on Windows

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 7.5 with network-reachable, unauthenticated availability impact and a high EPSS score, though exploitation is limited to denial of service and no KEV listing exists.

What it is

Django's NFKC normalization is slow on Windows, and django.contrib.auth.forms.UsernameField processes user-supplied Unicode input without limiting its size. An attacker can submit a username containing a very large number of Unicode characters to trigger excessive CPU consumption and deny service.

Impact

An unauthenticated attacker can tie up server resources and degrade or block availability of the Django application for legitimate users. There is no confidentiality or integrity impact; the effect is denial of service.

Attack surface

Reachable over the network through the authentication form's username field, which is typically exposed on login and registration endpoints. No authentication is required and no user interaction beyond submitting the crafted input is needed, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at roughly 0.498 (98.8th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Upgrade to Django 3.2.23, 4.1.13, or 4.2.7 or later, which contain the fix.
• If immediate patching is not possible, apply input length limits on username and other Unicode-normalized fields at the web server or form level.
• Rate-limit and throttle authentication and registration endpoints to reduce the impact of resource-exhaustion attempts.
• Monitor CPU usage on Windows-hosted Django instances and alert on abnormal spikes tied to authentication traffic.

Detection

• Alert on unusually long username values in login or registration request bodies and query strings.
• Monitor for high CPU consumption or request latency spikes correlated with authentication endpoint traffic.
• Review web server and application logs for repeated oversized POST requests to login or registration paths from single sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.