The vulnerable URLField method in Django calls Python's urllib.parse.urlsplit, which applies NFKC normalization when running on Windows. For certain Unicode characters this normalization is disproportionately slow, allowing a remote attacker to submit a very large URL that consumes excessive CPU time and memory, leading to denial of service. The flaw maps to CWE‑400 (Uncontrolled Resource Consumption) and CWE‑770 (Uncontrolled Resource Consumption).

The affected product is Django, specifically versions 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Earlier unsupported releases such as 5.0.x, 4.1.x and 3.2.x were not evaluated and may also be at risk.

The CVSS base score of 7.5 indicates high severity. The EPSS score of <1% suggests a low probability of exploitation as of the time of analysis, and the vulnerability is not included in the CISA KEV catalog. Exploitation requires an attacker to send a crafted URL that triggers the slow normalization on a Windows server running Django; the attack vector is remote over the network, inferred from the description.