---
title: "Notes de publication de Django 5.0.8"
version: 5.1
locale: fr
source: https://docs.djangoproject.com/fr/5.1/releases/5.0.8/
canonical: https://djangodocs.dev/fr/5.1/releases/5.0.8/
---
# Notes de publication de Django 5.0.8

*August 6, 2024*

Django 5.0.8 corrige trois problèmes de sécurité de sévérité moyenne, un problème de sécurité de sévérité élevée ainsi que plusieurs bogues dans 5.0.7.

## CVE-2024-41989: Memory exhaustion in `django.utils.numberformat.floatformat()`

If [`floatformat`](/fr/5.1/ref/templates/builtins/#std-templatefilter-floatformat) received a string representation of a number in
scientific notation with a large exponent, it could lead to significant memory
consumption.

To avoid this, decimals with more than 200 digits are now returned as is.

## CVE-2024-41990: Potential denial-of-service vulnerability in `django.utils.html.urlize()`

[`urlize`](/fr/5.1/ref/templates/builtins/#std-templatefilter-urlize) and [`urlizetrunc`](/fr/5.1/ref/templates/builtins/#std-templatefilter-urlizetrunc) were subject to a potential
denial-of-service attack via very large inputs with a specific sequence of
characters.

## CVE-2024-41991: Potential denial-of-service vulnerability in `django.utils.html.urlize()` and `AdminURLFieldWidget`

[`urlize`](/fr/5.1/ref/templates/builtins/#std-templatefilter-urlize), [`urlizetrunc`](/fr/5.1/ref/templates/builtins/#std-templatefilter-urlizetrunc), and `AdminURLFieldWidget` were
subject to a potential denial-of-service attack via certain inputs with a very
large number of Unicode characters.

## CVE-2024-42005: Potential SQL injection in `QuerySet.values()` and `values_list()`

[`QuerySet.values()`](/fr/5.1/ref/models/querysets/#django.db.models.query.QuerySet.values) and [`values_list()`](/fr/5.1/ref/models/querysets/#django.db.models.query.QuerySet.values_list) methods on models
with a `JSONField` were subject to SQL injection in column aliases, via a
crafted JSON object key as a passed `*arg`.

## Correction de bogues

- Ajout de validation manquante dans `UniqueConstraint(nulls_distinct=False)` lors de l’utilisation d”`*expressions` ([#35594](https://code.djangoproject.com/ticket/35594)).
- Correction d’une régression dans Django 5.0 où `ModelAdmin.action_checkbox` pouvait casser la page HTML de liste pour modifications du site d’administration lors du rendu d’une instance de modèle ayant une méthode `__html__` ([#35606](https://code.djangoproject.com/ticket/35606)).
- Fixed a crash when creating a model with a `Field.db_default` and a
  `Meta.constraints` constraint composed of `__endswith`, `__startswith`,
  or `__contains` lookups ([#35625](https://code.djangoproject.com/ticket/35625)).
- Fixed a regression in Django 5.0.7 that caused a crash in
  `LocaleMiddleware` when processing a language code over 500 characters
  ([#35627](https://code.djangoproject.com/ticket/35627)).
- Fixed a bug in Django 5.0 that caused a system check crash when
  `ModelAdmin.date_hierarchy` was a `GeneratedField` with an
  `output_field` of `DateField` or `DateTimeField` ([#35628](https://code.djangoproject.com/ticket/35628)).
- Fixed a bug in Django 5.0 which caused constraint validation to either crash
  or incorrectly raise validation errors for constraints referring to fields
  using `Field.db_default` ([#35638](https://code.djangoproject.com/ticket/35638)).
- Fixed a crash in Django 5.0 when saving a model containing a `FileField`
  with a `db_default` set ([#35657](https://code.djangoproject.com/ticket/35657)).