# Documentation Django 5.2.8

# Notes de publication de Django 5.0.8

August 6, 2024

Django 5.0.8 corrige trois problèmes de sécurité de sévérité moyenne, un problème de sécurité de sévérité élevée ainsi que plusieurs bogues dans 5.0.7.

## CVE-2024-41989: Memory exhaustion in `django.utils.numberformat.floatformat()`

If `floatformat` received a string representation of a number in scientific notation with a large exponent, it could lead to significant memory consumption.

To avoid this, decimals with more than 200 digits are now returned as is.

## CVE-2024-41990: Potential denial-of-service vulnerability in `django.utils.html.urlize()`

`urlize` and `urlizetrunc` were subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.

## CVE-2024-41991: Potential denial-of-service vulnerability in `django.utils.html.urlize()` and `AdminURLFieldWidget`

`urlize`, `urlizetrunc`, and `AdminURLFieldWidget` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

## CVE-2024-42005: Potential SQL injection in `QuerySet.values()` and `values_list()`

`QuerySet.values()` and `values_list()` methods on models with a `JSONField` were subject to SQL injection in column aliases, via a crafted JSON object key as a passed `*arg`.

## Correction de bogues

- Ajout de validation manquante dans `UniqueConstraint(nulls_distinct=False)` lors de l’utilisation d”`*expressions` (#35594).

- Correction d’une régression dans Django 5.0 où `ModelAdmin.action_checkbox` pouvait casser la page HTML de liste pour modifications du site d’administration lors du rendu d’une instance de modèle ayant une méthode `__html__` (#35606).

- Fixed a crash when creating a model with a `Field.db_default` and a `Meta.constraints` constraint composed of `__endswith`, `__startswith`, or `__contains` lookups (#35625).

- Fixed a regression in Django 5.0.7 that caused a crash in `LocaleMiddleware` when processing a language code over 500 characters (#35627).

- Fixed a bug in Django 5.0 that caused a system check crash when `ModelAdmin.date_hierarchy` was a `GeneratedField` with an `output_field` of `DateField` or `DateTimeField` (#35628).

- Fixed a bug in Django 5.0 which caused constraint validation to either crash or incorrectly raise validation errors for constraints referring to fields using `Field.db_default` (#35638).

- Fixed a crash in Django 5.0 when saving a model containing a `FileField` with a `db_default` set (#35657).