# Documentation Django 6.0.7

# Django 5.2.8 release notes

November 5, 2025

Django 5.2.8 fixes one security issue with severity « high », one security issue with severity « moderate », and several bugs in 5.2.7. It also adds compatibility with Python 3.14.

## CVE-2025-64458: Potential denial-of-service vulnerability in `HttpResponseRedirect` and `HttpResponsePermanentRedirect` on Windows

Python’s `NFKC normalization` is slow on Windows. As a consequence, `HttpResponseRedirect`, `HttpResponsePermanentRedirect`, and the shortcut `redirect()` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters (follow up to CVE 2025-27556).

## CVE-2025-64459: Potential SQL injection via `_connector` keyword argument

`QuerySet.filter()`, `exclude()`, `get()`, and `Q` were subject to SQL injection using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument.

## Correction de bogues

- Added compatibility for `oracledb` 3.4.0 (#36646).

- Fixed a bug in Django 5.2 where `QuerySet.first()` and `QuerySet.last()` raised an error on querysets performing aggregation that selected all fields of a composite primary key (#36648).

- Fixed a bug in Django 5.2 where proxy models having a `CompositePrimaryKey` incorrectly raised a `models.E042` system check error (#36704).