The vulnerability arises from Django's URLField.to_python() method invoking urllib.parse.urlsplit(), which on Windows platforms performs NFKC Unicode normalization that is disproportionately slow for some Unicode characters. This behavior allows a remote attacker to supply large URL inputs with these characters, leading to excessive resource consumption and denial of service. The affected versions are Django 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Unsupported earlier series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated but may also be vulnerable. The CVSS 3.1 base score is 7.5 (high), reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability.

An attacker can cause a denial of service by sending specially crafted large URLs containing certain Unicode characters that trigger slow normalization processing on Windows. This leads to uncontrolled resource consumption, potentially degrading or crashing the affected Django application. There is no confidentiality or integrity impact reported.

The vulnerability affects Django versions prior to 6.0.3, 5.2.12, and 4.2.29. Applying official patches by upgrading to these fixed versions or later is the recommended mitigation. The Red Hat advisory is available for reference but does not explicitly confirm patch availability; therefore, check the official Django releases for updates. No alternative mitigations or workarounds are specified. Since this is not a cloud service, remediation depends on applying updates.