mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-11-07 07:15:35 +00:00
Code Issues 32 Releases Wiki Activity

[5.1.x] Fixed CVE-2025-26699 -- Mitigated potential DoS in wordwrap template filter.

Browse Source 
Thanks sw0rd1ight for the report.

Backport of 55d89e25f4 from main.
This commit is contained in:
Sarah Boyce
2025-02-25 09:40:54 +01:00
parent d7dc1f6db0
commit 8dbb44d342
5 changed files with 39 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/releases/4.2.20.txt
View File

@@ -5,3 +5,9 @@ Django 4.2.20 release notes
*March 6, 2025*
Django 4.2.20 fixes a security issue with severity "moderate" in 4.2.19.
CVE-2025-26699: Potential denial-of-service vulnerability in ``django.utils.text.wrap()``
=========================================================================================
The ``wrap()`` and :tfilter:`wordwrap` template filter were subject to a
potential denial-of-service attack when used with very long strings.

6
docs/releases/5.0.13.txt
View File

@@ -5,3 +5,9 @@ Django 5.0.13 release notes
*March 6, 2025*
Django 5.0.13 fixes a security issue with severity "moderate" in 5.0.12.
CVE-2025-26699: Potential denial-of-service vulnerability in ``django.utils.text.wrap()``
=========================================================================================
The ``wrap()`` and :tfilter:`wordwrap` template filter were subject to a
potential denial-of-service attack when used with very long strings.

6
docs/releases/5.1.7.txt
View File

@@ -7,6 +7,12 @@ Django 5.1.7 release notes
Django 5.1.7 fixes a security issue with severity "moderate" and several bugs
in 5.1.6.
CVE-2025-26699: Potential denial-of-service vulnerability in ``django.utils.text.wrap()``
=========================================================================================
The ``wrap()`` and :tfilter:`wordwrap` template filter were subject to a
potential denial-of-service attack when used with very long strings.
Bugfixes
========