{"title":"Django 5.0.8 release notes","version":"dev","locale":"en","docname":"releases/5.0.8","url":"/en/dev/releases/5.0.8/","canonical":"https://djangodocs.dev/en/dev/releases/5.0.8/","summary":"Django 5.0.8 fixes three security issues with severity “moderate”, one security issue with severity “high”, and several bugs in 5.0.7.","html":"<h1>Django 5.0.8 release notes<a class=\"heading-anchor\" href=\"#django-5-0-8-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>August 6, 2024</em></p>\n<p>Django 5.0.8 fixes three security issues with severity “moderate”, one security\nissue with severity “high”, and several bugs in 5.0.7.</p>\n<section id=\"cve-2024-41989-memory-exhaustion-in-django-utils-numberformat-floatformat\">\n<h2>CVE-2024-41989: Memory exhaustion in <code class=\"docutils literal notranslate\">django.utils.numberformat.floatformat()</code><a class=\"heading-anchor\" href=\"#cve-2024-41989-memory-exhaustion-in-django-utils-numberformat-floatformat\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>If <a class=\"reference internal\" href=\"/en/dev/ref/templates/builtins/#std-templatefilter-floatformat\"><code class=\"xref std std-tfilter docutils literal notranslate\">floatformat</code></a> received a string representation of a number in\nscientific notation with a large exponent, it could lead to significant memory\nconsumption.</p>\n<p>To avoid this, decimals with more than 200 digits are now returned as is.</p>\n</section>\n<section id=\"cve-2024-41990-potential-denial-of-service-vulnerability-in-django-utils-html-urlize\">\n<h2>CVE-2024-41990: Potential denial-of-service vulnerability in <code class=\"docutils literal notranslate\">django.utils.html.urlize()</code><a class=\"heading-anchor\" href=\"#cve-2024-41990-potential-denial-of-service-vulnerability-in-django-utils-html-urlize\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p><a class=\"reference internal\" href=\"/en/dev/ref/templates/builtins/#std-templatefilter-urlize\"><code class=\"xref std std-tfilter docutils literal notranslate\">urlize</code></a> and <a class=\"reference internal\" href=\"/en/dev/ref/templates/builtins/#std-templatefilter-urlizetrunc\"><code class=\"xref std std-tfilter docutils literal notranslate\">urlizetrunc</code></a> were subject to a potential\ndenial-of-service attack via very large inputs with a specific sequence of\ncharacters.</p>\n</section>\n<section id=\"cve-2024-41991-potential-denial-of-service-vulnerability-in-django-utils-html-urlize-and-adminurlfieldwidget\">\n<h2>CVE-2024-41991: Potential denial-of-service vulnerability in <code class=\"docutils literal notranslate\">django.utils.html.urlize()</code> and <code class=\"docutils literal notranslate\">AdminURLFieldWidget</code><a class=\"heading-anchor\" href=\"#cve-2024-41991-potential-denial-of-service-vulnerability-in-django-utils-html-urlize-and-adminurlfieldwidget\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p><a class=\"reference internal\" href=\"/en/dev/ref/templates/builtins/#std-templatefilter-urlize\"><code class=\"xref std std-tfilter docutils literal notranslate\">urlize</code></a>, <a class=\"reference internal\" href=\"/en/dev/ref/templates/builtins/#std-templatefilter-urlizetrunc\"><code class=\"xref std std-tfilter docutils literal notranslate\">urlizetrunc</code></a>, and <code class=\"docutils literal notranslate\">AdminURLFieldWidget</code> were\nsubject to a potential denial-of-service attack via certain inputs with a very\nlarge number of Unicode characters.</p>\n</section>\n<section id=\"cve-2024-42005-potential-sql-injection-in-queryset-values-and-values-list\">\n<h2>CVE-2024-42005: Potential SQL injection in <code class=\"docutils literal notranslate\">QuerySet.values()</code> and <code class=\"docutils literal notranslate\">values_list()</code><a class=\"heading-anchor\" href=\"#cve-2024-42005-potential-sql-injection-in-queryset-values-and-values-list\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p><a class=\"reference internal\" href=\"/en/dev/ref/models/querysets/#django.db.models.query.QuerySet.values\" title=\"django.db.models.query.QuerySet.values\"><code class=\"xref py py-meth docutils literal notranslate\">QuerySet.values()</code></a> and <a class=\"reference internal\" href=\"/en/dev/ref/models/querysets/#django.db.models.query.QuerySet.values_list\" title=\"django.db.models.query.QuerySet.values_list\"><code class=\"xref py py-meth docutils literal notranslate\">values_list()</code></a> methods on models\nwith a <code class=\"docutils literal notranslate\">JSONField</code> were subject to SQL injection in column aliases, via a\ncrafted JSON object key as a passed <code class=\"docutils literal notranslate\">*arg</code>.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Added missing validation for <code class=\"docutils literal notranslate\">UniqueConstraint(nulls_distinct=False)</code> when\nusing <code class=\"docutils literal notranslate\">*expressions</code> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/35594\">#35594</a>).</p></li>\n<li><p>Fixed a regression in Django 5.0 where <code class=\"docutils literal notranslate\">ModelAdmin.action_checkbox</code> could\nbreak the admin changelist HTML page when rendering a model instance with a\n<code class=\"docutils literal notranslate\">__html__</code> method (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/35606\">#35606</a>).</p></li>\n<li><p>Fixed a crash when creating a model with a <code class=\"docutils literal notranslate\">Field.db_default</code> and a\n<code class=\"docutils literal notranslate\">Meta.constraints</code> constraint composed of <code class=\"docutils literal notranslate\">__endswith</code>, <code class=\"docutils literal notranslate\">__startswith</code>,\nor <code class=\"docutils literal notranslate\">__contains</code> lookups (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/35625\">#35625</a>).</p></li>\n<li><p>Fixed a regression in Django 5.0.7 that caused a crash in\n<code class=\"docutils literal notranslate\">LocaleMiddleware</code> when processing a language code over 500 characters\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/35627\">#35627</a>).</p></li>\n<li><p>Fixed a bug in Django 5.0 that caused a system check crash when\n<code class=\"docutils literal notranslate\">ModelAdmin.date_hierarchy</code> was a <code class=\"docutils literal notranslate\">GeneratedField</code> with an\n<code class=\"docutils literal notranslate\">output_field</code> of <code class=\"docutils literal notranslate\">DateField</code> or <code class=\"docutils literal notranslate\">DateTimeField</code> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/35628\">#35628</a>).</p></li>\n<li><p>Fixed a bug in Django 5.0 which caused constraint validation to either crash\nor incorrectly raise validation errors for constraints referring to fields\nusing <code class=\"docutils literal notranslate\">Field.db_default</code> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/35638\">#35638</a>).</p></li>\n<li><p>Fixed a crash in Django 5.0 when saving a model containing a <code class=\"docutils literal notranslate\">FileField</code>\nwith a <code class=\"docutils literal notranslate\">db_default</code> set (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/35657\">#35657</a>).</p></li>\n</ul>\n</section>","rootId":"django-5-0-8-release-notes","toc":[{"title":"CVE-2024-41989: Memory exhaustion in django.utils.numberformat.floatformat()","anchor":"cve-2024-41989-memory-exhaustion-in-django-utils-numberformat-floatformat","children":[]},{"title":"CVE-2024-41990: Potential denial-of-service vulnerability in django.utils.html.urlize()","anchor":"cve-2024-41990-potential-denial-of-service-vulnerability-in-django-utils-html-urlize","children":[]},{"title":"CVE-2024-41991: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget","anchor":"cve-2024-41991-potential-denial-of-service-vulnerability-in-django-utils-html-urlize-and-adminurlfieldwidget","children":[]},{"title":"CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list()","anchor":"cve-2024-42005-potential-sql-injection-in-queryset-values-and-values-list","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/5.0.9","title":"Django 5.0.9 release notes","url":"/en/dev/releases/5.0.9/"},"next":{"docname":"releases/5.0.7","title":"Django 5.0.7 release notes","url":"/en/dev/releases/5.0.7/"},"formats":{"html":"/en/dev/releases/5.0.8/","markdown":"/en/dev/releases/5.0.8.md","json":"/en/dev/releases/5.0.8.json"},"source":"https://github.com/django/django/blob/main/docs/releases/5.0.8.txt","official":"https://docs.djangoproject.com/en/dev/releases/5.0.8/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0"],"inLocales":["en"]}