Django - 4.1.6
Security
Django 4.1.6 release notes
February 1, 2023
Django 4.1.6 fixes a security issue with severity “moderate” and a bug in
4.1.5.
CVE-2023-23969: Potential denial-of-service via Accept-Language
headers
The parsed values of Accept-Language
headers are cached in order to avoid
repetitive parsing. This leads to a potential denial-of-service vector via
excessive memory usage if large header values are sent.
In order to avoid this vulnerability, the Accept-Language
header is now
parsed up to a maximum length.
Bugfixes
- Fixed a bug in Django 4.1 that caused a crash of model validation on
UniqueConstraint
with ordered expressions (#34291).
Security
Details
date
Feb. 1, 2023, 8:52 a.m.
type
Patch
official page
👇
Register or login to:
- 🔍View and search all Django releases.
- 🛠️Create and share lists to track your tools.
- 🚨Setup notifications for major, security, feature or patch updates.
- 🚀Much more coming soon!