{"title":"Django 6.0.3 release notes","version":"dev","locale":"en","docname":"releases/6.0.3","url":"/en/dev/releases/6.0.3/","canonical":"https://djangodocs.dev/en/dev/releases/6.0.3/","summary":"Django 6.0.3 fixes a security issue with severity “moderate”, a security issue with severity “low”, and several bugs in 6.0.2.","html":"

Django 6.0.3 release notesLink to this heading#

\n

March 3, 2026

\n

Django 6.0.3 fixes a security issue with severity “moderate”, a security issue\nwith severity “low”, and several bugs in 6.0.2.

\n
\n

CVE-2026-25673: Potential denial-of-service vulnerability in URLField via Unicode normalization on WindowsLink to this heading#

\n

The URLField form field’s to_python() method used\nurlsplit() to determine whether to prepend a URL scheme to\nthe submitted value. On Windows, urlsplit() performs\nNFKC normalization, which can be\ndisproportionately slow for large inputs containing certain characters.

\n

URLField.to_python() now uses a simplified scheme detection, avoiding\nUnicode normalization entirely and deferring URL validation to the appropriate\nlayers. As a result, while leading and trailing whitespace is still stripped by\ndefault, characters such as newlines, tabs, and other control characters within\nthe value are no longer handled by URLField.to_python(). When using the\ndefault URLValidator, these values will\ncontinue to raise ValidationError during\nvalidation, but if you rely on custom validators, ensure they do not depend on\nthe previous behavior of URLField.to_python().

\n

This issue has severity “moderate” according to the Django security\npolicy.

\n
\n
\n

CVE-2026-25674: Potential incorrect permissions on newly created file system objectsLink to this heading#

\n

Django’s file-system storage and file-based cache backends used the process\numask to control permissions when creating directories. In multi-threaded\nenvironments, one thread’s temporary umask change can affect other threads’\nfile and directory creation, resulting in file system objects being created\nwith unintended permissions.

\n

Django now applies the requested permissions via chmod() after\nmkdir(), removing the dependency on the process-wide umask.

\n

This issue has severity “low” according to the Django security policy.

\n
\n
\n

BugfixesLink to this heading#

\n\n
","rootId":"django-6-0-3-release-notes","toc":[{"title":"CVE-2026-25673: Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows","anchor":"cve-2026-25673-potential-denial-of-service-vulnerability-in-urlfield-via-unicode-normalization-on-windows","children":[]},{"title":"CVE-2026-25674: Potential incorrect permissions on newly created file system objects","anchor":"cve-2026-25674-potential-incorrect-permissions-on-newly-created-file-system-objects","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/6.0.4","title":"Django 6.0.4 release notes","url":"/en/dev/releases/6.0.4/"},"next":{"docname":"releases/6.0.2","title":"Django 6.0.2 release notes","url":"/en/dev/releases/6.0.2/"},"formats":{"html":"/en/dev/releases/6.0.3/","markdown":"/en/dev/releases/6.0.3.md","json":"/en/dev/releases/6.0.3.json"},"source":"https://github.com/django/django/blob/main/docs/releases/6.0.3.txt","official":"https://docs.djangoproject.com/en/dev/releases/6.0.3/","inVersions":["dev","6.1","6.0"],"inLocales":["en"]}