---
title: "Catatan terbitan Django 5.0.8"
version: 6.0
locale: id
source: https://docs.djangoproject.com/id/6.0/releases/5.0.8/
canonical: https://djangodocs.dev/id/6.0/releases/5.0.8/
---
# Catatan terbitan Django 5.0.8

*August 6, 2024*

Django 5.0.8 fixes three security issues with severity "moderate", one security
issue with severity "high", and several bugs in 5.0.7.

## CVE-2024-41989: Memory exhaustion in `django.utils.numberformat.floatformat()`

If [`floatformat`](/id/6.0/ref/templates/builtins/#std-templatefilter-floatformat) received a string representation of a number in
scientific notation with a large exponent, it could lead to significant memory
consumption.

To avoid this, decimals with more than 200 digits are now returned as is.

## CVE-2024-41990: Potensi rentan denial-of-service di `django.utils.html.urlize()`

[`urlize`](/id/6.0/ref/templates/builtins/#std-templatefilter-urlize) and [`urlizetrunc`](/id/6.0/ref/templates/builtins/#std-templatefilter-urlizetrunc) were subject to a potential
denial-of-service attack via very large inputs with a specific sequence of
characters.

## CVE-2024-41991: Potensi rentan denial-of-service di `django.utils.html.urlize()` dan `AdminURLFieldWidget`

[`urlize`](/id/6.0/ref/templates/builtins/#std-templatefilter-urlize), [`urlizetrunc`](/id/6.0/ref/templates/builtins/#std-templatefilter-urlizetrunc), and `AdminURLFieldWidget` were
subject to a potential denial-of-service attack via certain inputs with a very
large number of Unicode characters.

## CVE-2024-42005: Potential SQL injection in `QuerySet.values()` and `values_list()`

[`QuerySet.values()`](/id/6.0/ref/models/querysets/#django.db.models.query.QuerySet.values) and [`values_list()`](/id/6.0/ref/models/querysets/#django.db.models.query.QuerySet.values_list) methods on models
with a `JSONField` were subject to SQL injection in column aliases, via a
crafted JSON object key as a passed `*arg`.

## Perbaikan kesalahan

- Added missing validation for `UniqueConstraint(nulls_distinct=False)` when
  using `*expressions` ([#35594](https://code.djangoproject.com/ticket/35594)).
- Fixed a regression in Django 5.0 where `ModelAdmin.action_checkbox` could
  break the admin changelist HTML page when rendering a model instance with a
  `__html__` method ([#35606](https://code.djangoproject.com/ticket/35606)).
- Fixed a crash when creating a model with a `Field.db_default` and a
  `Meta.constraints` constraint composed of `__endswith`, `__startswith`,
  or `__contains` lookups ([#35625](https://code.djangoproject.com/ticket/35625)).
- Fixed a regression in Django 5.0.7 that caused a crash in
  `LocaleMiddleware` when processing a language code over 500 characters
  ([#35627](https://code.djangoproject.com/ticket/35627)).
- Fixed a bug in Django 5.0 that caused a system check crash when
  `ModelAdmin.date_hierarchy` was a `GeneratedField` with an
  `output_field` of `DateField` or `DateTimeField` ([#35628](https://code.djangoproject.com/ticket/35628)).
- Fixed a bug in Django 5.0 which caused constraint validation to either crash
  or incorrectly raise validation errors for constraints referring to fields
  using `Field.db_default` ([#35638](https://code.djangoproject.com/ticket/35638)).
- Fixed a crash in Django 5.0 when saving a model containing a `FileField`
  with a `db_default` set ([#35657](https://code.djangoproject.com/ticket/35657)).