---
title: "Django 4.2.14 release notes"
version: 6.1
locale: en
source: https://docs.djangoproject.com/en/6.1/releases/4.2.14/
canonical: https://djangodocs.dev/en/6.1/releases/4.2.14/
---
# Django 4.2.14 release notes

*July 9, 2024*

Django 4.2.14 fixes two security issues with severity “moderate” and two
security issues with severity “low” in 4.2.13.

## CVE-2024-38875: Potential denial-of-service vulnerability in `django.utils.html.urlize()`

[`urlize`](/en/6.1/ref/templates/builtins/#std-templatefilter-urlize) and [`urlizetrunc`](/en/6.1/ref/templates/builtins/#std-templatefilter-urlizetrunc) were subject to a potential
denial-of-service attack via certain inputs with a very large number of
brackets.

## CVE-2024-39329: Username enumeration through timing difference for users with unusable passwords

The [`authenticate()`](/en/6.1/ref/contrib/auth/#django.contrib.auth.backends.ModelBackend.authenticate) method
allowed remote attackers to enumerate users via a timing attack involving login
requests for users with unusable passwords.

## CVE-2024-39330: Potential directory-traversal via `Storage.save()`

Derived classes of the [`Storage`](/en/6.1/ref/files/storage/#django.core.files.storage.Storage) base class
which override [`generate_filename()`](/en/6.1/ref/files/storage/#django.core.files.storage.Storage.generate_filename) without replicating
the file path validations existing in the parent class, allowed for potential
directory-traversal via certain inputs when calling [`save()`](/en/6.1/ref/files/storage/#django.core.files.storage.Storage.save).

Built-in `Storage` sub-classes were not affected by this vulnerability.

## CVE-2024-39614: Potential denial-of-service vulnerability in `get_supported_language_variant()`

[`get_supported_language_variant()`](/en/6.1/ref/utils/#django.utils.translation.get_supported_language_variant) was subject to
a potential denial-of-service attack when used with very long strings
containing specific characters.

To mitigate this vulnerability, the language code provided to
[`get_supported_language_variant()`](/en/6.1/ref/utils/#django.utils.translation.get_supported_language_variant) is now parsed
up to a maximum length of 500 characters.

When the language code is over 500 characters, a [`ValueError`](https://docs.python.org/3/library/exceptions.html#ValueError) will now be
raised if `strict` is `True`, or if there is no generic variant and
`strict` is `False`.