{"title":"Django 5.2.2 release notes","version":"dev","locale":"en","docname":"releases/5.2.2","url":"/en/dev/releases/5.2.2/","canonical":"https://djangodocs.dev/en/dev/releases/5.2.2/","summary":"Django 5.2.2 fixes a security issue with severity “low” and several bugs in 5.2.1.","html":"

Django 5.2.2 release notesLink to this heading#

\n

June 4, 2025

\n

Django 5.2.2 fixes a security issue with severity “low” and several bugs in\n5.2.1.

\n

\n

CVE-2025-48432: Potential log injection via unescaped request pathLink to this heading#

\n

Internal HTTP response logging used request.path directly, allowing control\ncharacters (e.g. newlines or ANSI escape sequences) to be written unescaped\ninto logs. This could enable log injection or forgery, letting attackers\nmanipulate log appearance or structure, especially in logs processed by\nexternal systems or viewed in terminals.

\n

Although this does not directly impact Django’s security model, it poses risks\nwhen logs are consumed or interpreted by other tools. To fix this, the internal\ndjango.utils.log.log_response() function now escapes all positional\nformatting arguments using a safe encoding.

\n

\n

\n

BugfixesLink to this heading#

\n

Fixed a crash when using select_related against a ForeignObject\noriginating from a model with a CompositePrimaryKey (#36373).
Fixed a bug in Django 5.2 where subqueries using "pk" to reference models\nwith a CompositePrimaryKey failed to raise ValueError when too many\nor too few columns were selected (#36392).
Fixed a regression in Django 5.2 that caused a crash when no arguments were\npassed into QuerySet.union() (#36388).
Fixed a regression in Django 5.2 where subclasses of RemoteUserMiddleware\nthat had overridden process_request() were no longer supported\n(#36390).
Fixed a regression in Django 5.2 that caused a crash when using OuterRef\nin the filter argument of an Aggregate expression (#36404).
Fixed a regression in Django 5.2 that caused a crash when using OuterRef\nin PostgreSQL aggregate functions ArrayAgg, StringAgg, and\nJSONBAgg (#36405).
Fixed a regression in Django 5.2 where admin’s filter_horizontal buttons\nlacked type="button", causing them to intercept form submission when\npressing the Enter key (#36423).
Fixed a bug in Django 5.2 where calling QuerySet.in_bulk() with an\nid_list argument on models with a CompositePrimaryKey failed to\nobserve database parameter limits (#36416).
Fixed a bug in Django 5.2 where HttpRequest.get_preferred_type() did not account for media type\nparameters in Accept headers, reducing specificity in content negotiation\n(#36411).
Fixed a regression in Django 5.2 that caused a crash when using\nQuerySet.prefetch_related() to prefetch a foreign key with a Prefetch\nqueryset for a subclass of the foreign target (#36432).

\n

","rootId":"django-5-2-2-release-notes","toc":[{"title":"CVE-2025-48432: Potential log injection via unescaped request path","anchor":"cve-2025-48432-potential-log-injection-via-unescaped-request-path","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/5.2.3","title":"Django 5.2.3 release notes","url":"/en/dev/releases/5.2.3/"},"next":{"docname":"releases/5.2.1","title":"Django 5.2.1 release notes","url":"/en/dev/releases/5.2.1/"},"formats":{"html":"/en/dev/releases/5.2.2/","markdown":"/en/dev/releases/5.2.2.md","json":"/en/dev/releases/5.2.2.json"},"source":"https://github.com/django/django/blob/main/docs/releases/5.2.2.txt","official":"https://docs.djangoproject.com/en/dev/releases/5.2.2/","inVersions":["dev","6.1","6.0","5.2"],"inLocales":["en"]}