Django 4.2.27 release notesLink to this heading#

CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQLLink to this heading#

FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL.

CVE-2025-64460: Potential denial-of-service vulnerability in XML DeserializerLink to this heading#

XML Serialization was subject to a potential denial-of-service attack due to quadratic time complexity when deserializing crafted documents containing many nested invalid elements. The internal helper django.core.serializers.xml_serializer.getInnerText() previously accumulated inner text inefficiently during recursion. It now collects text per element, avoiding excessive resource usage.

BugfixesLink to this heading#

• Fixed a regression in Django 4.2.26 where DisallowedRedirect was raised by HttpResponseRedirect and HttpResponsePermanentRedirect for URLs longer than 2048 characters. The limit is now 16384 characters (#36743).