Django security releases issued: 5.2.8, 5.1.14, and 4.2.26

[NewsBot]

A new Django blog post/announcement has been posted!

In accordance with our security release policy, the Django team is issuing releases for Django 5.2.8, Django 5.1.14, and Django 4.2.26. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

CVE-2025-64458: Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

NFKC normalization in Python is slow on Windows. As a consequence, HttpResponseRedirect, HttpResponsePermanentRedirect, and redirect were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report.

This issue has severity "moderate" according to the Django security policy.

CVE-2025-64459: Potential SQL injection via _connector keyword argument in QuerySet an...

Get the full details here: Django security releases issued: 5.2.8, 5.1.14, and 4.2.26 | Weblog | Django