---
title: "Django 4.2.15 release notes"
version: 5.1
locale: fr
source: https://docs.djangoproject.com/fr/5.1/releases/4.2.15/
canonical: https://djangodocs.dev/fr/5.1/releases/4.2.15/
---
# Django 4.2.15 release notes

*August 6, 2024*

Django 4.2.15 fixes three security issues with severity « moderate », one
security issue with severity « high », and a regression in 4.2.14.

## CVE-2024-41989: Memory exhaustion in `django.utils.numberformat.floatformat()`

If [`floatformat`](/fr/5.1/ref/templates/builtins/#std-templatefilter-floatformat) received a string representation of a number in
scientific notation with a large exponent, it could lead to significant memory
consumption.

To avoid this, decimals with more than 200 digits are now returned as is.

## CVE-2024-41990: Potential denial-of-service vulnerability in `django.utils.html.urlize()`

[`urlize`](/fr/5.1/ref/templates/builtins/#std-templatefilter-urlize) and [`urlizetrunc`](/fr/5.1/ref/templates/builtins/#std-templatefilter-urlizetrunc) were subject to a potential
denial-of-service attack via very large inputs with a specific sequence of
characters.

## CVE-2024-41991: Potential denial-of-service vulnerability in `django.utils.html.urlize()` and `AdminURLFieldWidget`

[`urlize`](/fr/5.1/ref/templates/builtins/#std-templatefilter-urlize), [`urlizetrunc`](/fr/5.1/ref/templates/builtins/#std-templatefilter-urlizetrunc), and `AdminURLFieldWidget` were
subject to a potential denial-of-service attack via certain inputs with a very
large number of Unicode characters.

## CVE-2024-42005: Potential SQL injection in `QuerySet.values()` and `values_list()`

[`QuerySet.values()`](/fr/5.1/ref/models/querysets/#django.db.models.query.QuerySet.values) and [`values_list()`](/fr/5.1/ref/models/querysets/#django.db.models.query.QuerySet.values_list) methods on models
with a `JSONField` were subject to SQL injection in column aliases, via a
crafted JSON object key as a passed `*arg`.

## Correction de bogues

- Fixed a regression in Django 4.2.14 that caused a crash in
  `LocaleMiddleware` when processing a language code over 500 characters
  ([#35627](https://code.djangoproject.com/ticket/35627)).