{"title":"Django 4.2.28 release notes","version":"dev","locale":"en","docname":"releases/4.2.28","url":"/en/dev/releases/4.2.28/","canonical":"https://djangodocs.dev/en/dev/releases/4.2.28/","summary":"Django 4.2.28 fixes three security issues with severity “high”, two security issues with severity “moderate”, and one security issue with severity “low” in…","html":"

Django 4.2.28 release notesLink to this heading#

\n

February 3, 2026

\n

Django 4.2.28 fixes three security issues with severity “high”, two security\nissues with severity “moderate”, and one security issue with severity “low” in\n4.2.27.

\n
\n

CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentication handlerLink to this heading#

\n

The django.contrib.auth.handlers.modwsgi.check_password() function for\nauthentication via mod_wsgi\nallowed remote attackers to enumerate users via a timing attack.

\n

This issue has severity “low” according to the Django security policy.

\n
\n
\n

CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGILink to this heading#

\n

When receiving duplicates of a single header, ASGIRequest allowed a remote\nattacker to cause a potential denial-of-service via a specifically created\nrequest with multiple duplicate headers. The vulnerability resulted from\nrepeated string concatenation while combining repeated headers, which\nproduced super-linear computation resulting in service degradation or outage.

\n

This issue has severity “moderate” according to the Django security\npolicy.

\n
\n
\n

CVE-2026-1207: Potential SQL injection via raster lookups on PostGISLink to this heading#

\n

Raster lookups on GIS fields (only implemented\non PostGIS) were subject to SQL injection if untrusted data was used as a band\nindex.

\n

As a reminder, all untrusted user input should be validated before use.

\n

This issue has severity “high” according to the Django security policy.

\n
\n
\n

CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methodsLink to this heading#

\n

django.utils.text.Truncator.chars() and Truncator.words() methods (with\nhtml=True) and the truncatechars_html and\ntruncatewords_html template filters were subject to a potential\ndenial-of-service attack via certain inputs with a large number of unmatched\nHTML end tags, which could cause quadratic time complexity during HTML parsing.

\n

This issue has severity “moderate” according to the Django security\npolicy.

\n
\n
\n

CVE-2026-1287: Potential SQL injection in column aliases via control charactersLink to this heading#

\n

FilteredRelation was subject to SQL injection in column aliases via\ncontrol characters, using a suitably crafted dictionary, with dictionary\nexpansion, as the **kwargs passed to QuerySet.annotate(),\naggregate(), extra(),\nvalues(), values_list(), and\nalias().

\n

This issue has severity “high” according to the Django security policy.

\n
\n
\n

CVE-2026-1312: Potential SQL injection via QuerySet.order_by and FilteredRelationLink to this heading#

\n

QuerySet.order_by() was subject to SQL injection in column aliases\ncontaining periods when the same alias was, using a suitably crafted\ndictionary, with dictionary expansion, used in FilteredRelation.

\n

This issue has severity “high” according to the Django security policy.

\n
","rootId":"django-4-2-28-release-notes","toc":[{"title":"CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentication handler","anchor":"cve-2025-13473-username-enumeration-through-timing-difference-in-mod-wsgi-authentication-handler","children":[]},{"title":"CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI","anchor":"cve-2025-14550-potential-denial-of-service-vulnerability-via-repeated-headers-when-using-asgi","children":[]},{"title":"CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS","anchor":"cve-2026-1207-potential-sql-injection-via-raster-lookups-on-postgis","children":[]},{"title":"CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods","anchor":"cve-2026-1285-potential-denial-of-service-vulnerability-in-django-utils-text-truncator-html-methods","children":[]},{"title":"CVE-2026-1287: Potential SQL injection in column aliases via control characters","anchor":"cve-2026-1287-potential-sql-injection-in-column-aliases-via-control-characters","children":[]},{"title":"CVE-2026-1312: Potential SQL injection via QuerySet.order_by and FilteredRelation","anchor":"cve-2026-1312-potential-sql-injection-via-queryset-order-by-and-filteredrelation","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/4.2.29","title":"Django 4.2.29 release notes","url":"/en/dev/releases/4.2.29/"},"next":{"docname":"releases/4.2.27","title":"Django 4.2.27 release notes","url":"/en/dev/releases/4.2.27/"},"formats":{"html":"/en/dev/releases/4.2.28/","markdown":"/en/dev/releases/4.2.28.md","json":"/en/dev/releases/4.2.28.json"},"source":"https://github.com/django/django/blob/main/docs/releases/4.2.28.txt","official":"https://docs.djangoproject.com/en/dev/releases/4.2.28/","inVersions":["dev","6.1","6.0","5.2","4.2"],"inLocales":["en"]}