March 3, 2026
Django 6.0.3 fixes a security issue with severity “moderate”, a security issue with severity “low”, and several bugs in 6.0.2.
URLField via Unicode normalization on Windows¶The URLField form field’s to_python() method used
urlsplit() to determine whether to prepend a URL scheme to
the submitted value. On Windows, urlsplit() performs
NFKC normalization, which can be
disproportionately slow for large inputs containing certain characters.
URLField.to_python() now uses a simplified scheme detection, avoiding
Unicode normalization entirely and deferring URL validation to the appropriate
layers. As a result, while leading and trailing whitespace is still stripped by
default, characters such as newlines, tabs, and other control characters within
the value are no longer handled by URLField.to_python(). When using the
default URLValidator, these values will
continue to raise ValidationError during
validation, but if you rely on custom validators, ensure they do not depend on
the previous behavior of URLField.to_python().
This issue has severity “moderate” according to the Django security policy.
Django’s file-system storage and file-based cache backends used the process
umask to control permissions when creating directories. In multi-threaded
environments, one thread’s temporary umask change can affect other threads’
file and directory creation, resulting in file system objects being created
with unintended permissions.
Django now applies the requested permissions via chmod() after
mkdir(), removing the dependency on the process-wide umask.
This issue has severity “low” according to the Django security policy.
Fixed NameError when inspecting functions making use of deferred
annotations in Python 3.14 (#36903).
Fixed AttributeError when subclassing builtin lookups and neglecting
to override as_sql() to accept any sequence
(#36934).
Fixed TypeError when deprecation warnings are emitted in environments
importing Django by namespace (#36961).
Fixed a visual regression where fieldset legends were misaligned in the admin (#36920).
Prevented the django.tasks.signals.task_finished signal from writing
extraneous log messages when no exceptions are encountered (#36951).
Mar 15, 2026