Django - 4.2.7


Django 4.2.7 release notes

November 1, 2023

Django 4.2.7 fixes a security issue with severity “moderate” and several bugs
in 4.2.6.

CVE-2023-46695: Potential denial of service vulnerability in UsernameField on Windows

The NFKC normalization is slow on
Windows. As a consequence, django.contrib.auth.forms.UsernameField was
subject to a potential denial of service attack via certain inputs with a very
large number of Unicode characters.

In order to avoid the vulnerability, invalid values longer than
UsernameField.max\_length are no longer normalized, since they cannot pass
validation anyway.


  • Fixed a regression in Django 4.2 that caused a crash of
    QuerySet.aggregate() with aggregates referencing expressions containing
    subqueries (#34798).
  • Restored, following a regression in Django 4.2, creating
    varchar/text\_pattern\_ops indexes on CharField and TextField with
    deterministic collations on PostgreSQL (#34932).


Nov. 1, 2023, 5:23 a.m.
Register or login to:
  • 🔍View and search all Django releases.
  • 🛠️Create and share lists to track your tools.
  • 🚨Setup notifications for major, security, feature or patch updates.
  • 🚀Much more coming soon!
Continue with GitHub
Continue with Google