{"title":"Django 4.2.15 release notes","version":"dev","locale":"en","docname":"releases/4.2.15","url":"/en/dev/releases/4.2.15/","canonical":"https://djangodocs.dev/en/dev/releases/4.2.15/","summary":"Django 4.2.15 fixes three security issues with severity “moderate”, one security issue with severity “high”, and a regression in 4.2.14.","html":"<h1>Django 4.2.15 release notes<a class=\"heading-anchor\" href=\"#django-4-2-15-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>August 6, 2024</em></p>\n<p>Django 4.2.15 fixes three security issues with severity “moderate”, one\nsecurity issue with severity “high”, and a regression in 4.2.14.</p>\n<section id=\"cve-2024-41989-memory-exhaustion-in-django-utils-numberformat-floatformat\">\n<h2>CVE-2024-41989: Memory exhaustion in <code class=\"docutils literal notranslate\">django.utils.numberformat.floatformat()</code><a class=\"heading-anchor\" href=\"#cve-2024-41989-memory-exhaustion-in-django-utils-numberformat-floatformat\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>If <a class=\"reference internal\" href=\"/en/dev/ref/templates/builtins/#std-templatefilter-floatformat\"><code class=\"xref std std-tfilter docutils literal notranslate\">floatformat</code></a> received a string representation of a number in\nscientific notation with a large exponent, it could lead to significant memory\nconsumption.</p>\n<p>To avoid this, decimals with more than 200 digits are now returned as is.</p>\n</section>\n<section id=\"cve-2024-41990-potential-denial-of-service-vulnerability-in-django-utils-html-urlize\">\n<h2>CVE-2024-41990: Potential denial-of-service vulnerability in <code class=\"docutils literal notranslate\">django.utils.html.urlize()</code><a class=\"heading-anchor\" href=\"#cve-2024-41990-potential-denial-of-service-vulnerability-in-django-utils-html-urlize\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p><a class=\"reference internal\" href=\"/en/dev/ref/templates/builtins/#std-templatefilter-urlize\"><code class=\"xref std std-tfilter docutils literal notranslate\">urlize</code></a> and <a class=\"reference internal\" href=\"/en/dev/ref/templates/builtins/#std-templatefilter-urlizetrunc\"><code class=\"xref std std-tfilter docutils literal notranslate\">urlizetrunc</code></a> were subject to a potential\ndenial-of-service attack via very large inputs with a specific sequence of\ncharacters.</p>\n</section>\n<section id=\"cve-2024-41991-potential-denial-of-service-vulnerability-in-django-utils-html-urlize-and-adminurlfieldwidget\">\n<h2>CVE-2024-41991: Potential denial-of-service vulnerability in <code class=\"docutils literal notranslate\">django.utils.html.urlize()</code> and <code class=\"docutils literal notranslate\">AdminURLFieldWidget</code><a class=\"heading-anchor\" href=\"#cve-2024-41991-potential-denial-of-service-vulnerability-in-django-utils-html-urlize-and-adminurlfieldwidget\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p><a class=\"reference internal\" href=\"/en/dev/ref/templates/builtins/#std-templatefilter-urlize\"><code class=\"xref std std-tfilter docutils literal notranslate\">urlize</code></a>, <a class=\"reference internal\" href=\"/en/dev/ref/templates/builtins/#std-templatefilter-urlizetrunc\"><code class=\"xref std std-tfilter docutils literal notranslate\">urlizetrunc</code></a>, and <code class=\"docutils literal notranslate\">AdminURLFieldWidget</code> were\nsubject to a potential denial-of-service attack via certain inputs with a very\nlarge number of Unicode characters.</p>\n</section>\n<section id=\"cve-2024-42005-potential-sql-injection-in-queryset-values-and-values-list\">\n<h2>CVE-2024-42005: Potential SQL injection in <code class=\"docutils literal notranslate\">QuerySet.values()</code> and <code class=\"docutils literal notranslate\">values_list()</code><a class=\"heading-anchor\" href=\"#cve-2024-42005-potential-sql-injection-in-queryset-values-and-values-list\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p><a class=\"reference internal\" href=\"/en/dev/ref/models/querysets/#django.db.models.query.QuerySet.values\" title=\"django.db.models.query.QuerySet.values\"><code class=\"xref py py-meth docutils literal notranslate\">QuerySet.values()</code></a> and <a class=\"reference internal\" href=\"/en/dev/ref/models/querysets/#django.db.models.query.QuerySet.values_list\" title=\"django.db.models.query.QuerySet.values_list\"><code class=\"xref py py-meth docutils literal notranslate\">values_list()</code></a> methods on models\nwith a <code class=\"docutils literal notranslate\">JSONField</code> were subject to SQL injection in column aliases, via a\ncrafted JSON object key as a passed <code class=\"docutils literal notranslate\">*arg</code>.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed a regression in Django 4.2.14 that caused a crash in\n<code class=\"docutils literal notranslate\">LocaleMiddleware</code> when processing a language code over 500 characters\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/35627\">#35627</a>).</p></li>\n</ul>\n</section>","rootId":"django-4-2-15-release-notes","toc":[{"title":"CVE-2024-41989: Memory exhaustion in django.utils.numberformat.floatformat()","anchor":"cve-2024-41989-memory-exhaustion-in-django-utils-numberformat-floatformat","children":[]},{"title":"CVE-2024-41990: Potential denial-of-service vulnerability in django.utils.html.urlize()","anchor":"cve-2024-41990-potential-denial-of-service-vulnerability-in-django-utils-html-urlize","children":[]},{"title":"CVE-2024-41991: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget","anchor":"cve-2024-41991-potential-denial-of-service-vulnerability-in-django-utils-html-urlize-and-adminurlfieldwidget","children":[]},{"title":"CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list()","anchor":"cve-2024-42005-potential-sql-injection-in-queryset-values-and-values-list","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/4.2.16","title":"Django 4.2.16 release notes","url":"/en/dev/releases/4.2.16/"},"next":{"docname":"releases/4.2.14","title":"Django 4.2.14 release notes","url":"/en/dev/releases/4.2.14/"},"formats":{"html":"/en/dev/releases/4.2.15/","markdown":"/en/dev/releases/4.2.15.md","json":"/en/dev/releases/4.2.15.json"},"source":"https://github.com/django/django/blob/main/docs/releases/4.2.15.txt","official":"https://docs.djangoproject.com/en/dev/releases/4.2.15/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2"],"inLocales":["en"]}