---
title: "Django 4.2.27 リリースノート"
version: 6.0
locale: ja
source: https://docs.djangoproject.com/ja/6.0/releases/4.2.27/
canonical: https://djangodocs.dev/ja/6.0/releases/4.2.27/
---
# Django 4.2.27 リリースノート

*2025年12月2日*

Django 4.2.27 fixes one security issue with severity "high", one security issue
with severity "moderate", and one bug in 4.2.26.

## CVE-2025-13372: Potential SQL injection in `FilteredRelation` column aliases on PostgreSQL

[`FilteredRelation`](/ja/6.0/ref/models/querysets/#django.db.models.FilteredRelation) was subject to SQL injection in column aliases,
using a suitably crafted dictionary, with dictionary expansion, as the
`**kwargs` passed to [`QuerySet.annotate()`](/ja/6.0/ref/models/querysets/#django.db.models.query.QuerySet.annotate) or [`QuerySet.alias()`](/ja/6.0/ref/models/querysets/#django.db.models.query.QuerySet.alias) on
PostgreSQL.

## CVE-2025-64460: Potential denial-of-service vulnerability in XML `Deserializer`

[XML Serialization](/ja/6.0/topics/serialization/#serialization-formats-xml) was subject to a potential
denial-of-service attack due to quadratic time complexity when deserializing
crafted documents containing many nested invalid elements. The internal helper
`django.core.serializers.xml_serializer.getInnerText()` previously
accumulated inner text inefficiently during recursion. It now collects text per
element, avoiding excessive resource usage.

## バグ修正

- Fixed a regression in Django 4.2.26 where `DisallowedRedirect` was raised
  by [`HttpResponseRedirect`](/ja/6.0/ref/request-response/#django.http.HttpResponseRedirect) and
  [`HttpResponsePermanentRedirect`](/ja/6.0/ref/request-response/#django.http.HttpResponsePermanentRedirect) for URLs longer than 2048
  characters. The limit is now 16384 characters ([#36743](https://code.djangoproject.com/ticket/36743)).