---
title: "Django 4.2.28 release notes"
version: 5.2
locale: pt-br
source: https://docs.djangoproject.com/pt-br/5.2/releases/4.2.28/
canonical: https://djangodocs.dev/pt-br/5.2/releases/4.2.28/
---
# Django 4.2.28 release notes

*February 3, 2026*

Django 4.2.28 fixes three security issues with severity “high”, two security
issues with severity “moderate”, and one security issue with severity “low” in
4.2.27.

## CVE-2025-13473: Username enumeration through timing difference in mod\_wsgi authentication handler

The `django.contrib.auth.handlers.modwsgi.check_password()` function for
[authentication via mod\_wsgi](/pt-br/5.2/howto/deployment/wsgi/apache-auth/)
allowed remote attackers to enumerate users via a timing attack.

This issue has severity “low” according to the [Django security policy](/pt-br/5.2/internals/security/#severity-levels).

## CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI

When receiving duplicates of a single header, `ASGIRequest` allowed a remote
attacker to cause a potential denial-of-service via a specifically created
request with multiple duplicate headers. The vulnerability resulted from
repeated string concatenation while combining repeated headers, which
produced super-linear computation resulting in service degradation or outage.

This issue has severity “moderate” according to the [Django security
policy](/pt-br/5.2/internals/security/#severity-levels).

## CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS

[Raster lookups](/pt-br/5.2/ref/contrib/gis/db-api/#spatial-lookup-raster) on GIS fields (only implemented
on PostGIS) were subject to SQL injection if untrusted data was used as a band
index.

As a reminder, all untrusted user input should be validated before use.

This issue has severity “high” according to the [Django security policy](/pt-br/5.2/internals/security/#severity-levels).

## CVE-2026-1285: Potential denial-of-service vulnerability in `django.utils.text.Truncator` HTML methods

`django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with
`html=True`) and the [`truncatechars_html`](/pt-br/5.2/ref/templates/builtins/#std-templatefilter-truncatechars_html) and
[`truncatewords_html`](/pt-br/5.2/ref/templates/builtins/#std-templatefilter-truncatewords_html) template filters were subject to a potential
denial-of-service attack via certain inputs with a large number of unmatched
HTML end tags, which could cause quadratic time complexity during HTML parsing.

This issue has severity “moderate” according to the [Django security
policy](/pt-br/5.2/internals/security/#severity-levels).

## CVE-2026-1287: Potential SQL injection in column aliases via control characters

[`FilteredRelation`](/pt-br/5.2/ref/models/querysets/#django.db.models.FilteredRelation) was subject to SQL injection in column aliases via
control characters, using a suitably crafted dictionary, with dictionary
expansion, as the `**kwargs` passed to [`QuerySet.annotate()`](/pt-br/5.2/ref/models/querysets/#django.db.models.query.QuerySet.annotate),
[`aggregate()`](/pt-br/5.2/ref/models/querysets/#django.db.models.query.QuerySet.aggregate), [`extra()`](/pt-br/5.2/ref/models/querysets/#django.db.models.query.QuerySet.extra),
[`values()`](/pt-br/5.2/ref/models/querysets/#django.db.models.query.QuerySet.values), [`values_list()`](/pt-br/5.2/ref/models/querysets/#django.db.models.query.QuerySet.values_list), and
[`alias()`](/pt-br/5.2/ref/models/querysets/#django.db.models.query.QuerySet.alias).

This issue has severity “high” according to the [Django security policy](/pt-br/5.2/internals/security/#severity-levels).

## CVE-2026-1312: Potential SQL injection via `QuerySet.order_by` and `FilteredRelation`

[`QuerySet.order_by()`](/pt-br/5.2/ref/models/querysets/#django.db.models.query.QuerySet.order_by) was subject to SQL injection in column aliases
containing periods when the same alias was, using a suitably crafted
dictionary, with dictionary expansion, used in [`FilteredRelation`](/pt-br/5.2/ref/models/querysets/#django.db.models.FilteredRelation).

This issue has severity “high” according to the [Django security policy](/pt-br/5.2/internals/security/#severity-levels).