March 3, 2026
\nDjango 5.2.12 fixes a security issue with severity “moderate” and a security\nissue with severity “low” in 5.2.11. It also fixes one bug related to support\nfor Python 3.14.
\nURLField via Unicode normalization on WindowsLink to this heading#The URLField form field’s to_python() method used\nurlsplit() to determine whether to prepend a URL scheme to\nthe submitted value. On Windows, urlsplit() performs\nNFKC normalization, which can be\ndisproportionately slow for large inputs containing certain characters.
URLField.to_python() now uses a simplified scheme detection, avoiding\nUnicode normalization entirely and deferring URL validation to the appropriate\nlayers. As a result, while leading and trailing whitespace is still stripped by\ndefault, characters such as newlines, tabs, and other control characters within\nthe value are no longer handled by URLField.to_python(). When using the\ndefault URLValidator, these values will\ncontinue to raise ValidationError during\nvalidation, but if you rely on custom validators, ensure they do not depend on\nthe previous behavior of URLField.to_python().
This issue has severity “moderate” according to the Django security\npolicy.
\nDjango’s file-system storage and file-based cache backends used the process\numask to control permissions when creating directories. In multi-threaded\nenvironments, one thread’s temporary umask change can affect other threads’\nfile and directory creation, resulting in file system objects being created\nwith unintended permissions.
Django now applies the requested permissions via chmod() after\nmkdir(), removing the dependency on the process-wide umask.
This issue has severity “low” according to the Django security policy.
\n