{"title":"Django 4.2.22 release notes","version":"dev","locale":"en","docname":"releases/4.2.22","url":"/en/dev/releases/4.2.22/","canonical":"https://djangodocs.dev/en/dev/releases/4.2.22/","summary":"Django 4.2.22 fixes a security issue with severity “low” in 4.2.21. Internal HTTP response logging used request.path directly, allowing control characters…","html":"<h1>Django 4.2.22 release notes<a class=\"heading-anchor\" href=\"#django-4-2-22-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>June 4, 2025</em></p>\n<p>Django 4.2.22 fixes a security issue with severity “low” in 4.2.21.</p>\n<section id=\"cve-2025-48432-potential-log-injection-via-unescaped-request-path\">\n<h2>CVE-2025-48432: Potential log injection via unescaped request path<a class=\"heading-anchor\" href=\"#cve-2025-48432-potential-log-injection-via-unescaped-request-path\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>Internal HTTP response logging used <code class=\"docutils literal notranslate\">request.path</code> directly, allowing control\ncharacters (e.g. newlines or ANSI escape sequences) to be written unescaped\ninto logs. This could enable log injection or forgery, letting attackers\nmanipulate log appearance or structure, especially in logs processed by\nexternal systems or viewed in terminals.</p>\n<p>Although this does not directly impact Django’s security model, it poses risks\nwhen logs are consumed or interpreted by other tools. To fix this, the internal\n<code class=\"docutils literal notranslate\">django.utils.log.log_response()</code> function now escapes all positional\nformatting arguments using a safe encoding.</p>\n</section>","rootId":"django-4-2-22-release-notes","toc":[{"title":"CVE-2025-48432: Potential log injection via unescaped request path","anchor":"cve-2025-48432-potential-log-injection-via-unescaped-request-path","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/4.2.23","title":"Django 4.2.23 release notes","url":"/en/dev/releases/4.2.23/"},"next":{"docname":"releases/4.2.21","title":"Django 4.2.21 release notes","url":"/en/dev/releases/4.2.21/"},"formats":{"html":"/en/dev/releases/4.2.22/","markdown":"/en/dev/releases/4.2.22.md","json":"/en/dev/releases/4.2.22.json"},"source":"https://github.com/django/django/blob/main/docs/releases/4.2.22.txt","official":"https://docs.djangoproject.com/en/dev/releases/4.2.22/","inVersions":["dev","6.1","6.0","5.2","5.1","4.2"],"inLocales":["en"]}