1. ===========================

  2. Django 4.1.13 release notes

  3. ===========================

  4. 

  5. *November 1, 2023*

  6. 

  7. Django 4.1.13 fixes a security issue with severity "moderate" in 4.1.12.

  8. 

  9. CVE-2023-46695: Potential denial of service vulnerability in ``UsernameField`` on Windows

  10. =========================================================================================

  11. 

  12. The :func:`NFKC normalization <python:unicodedata.normalize>` is slow on

  13. Windows. As a consequence, ``django.contrib.auth.forms.UsernameField`` was

  14. subject to a potential denial of service attack via certain inputs with a very

  15. large number of Unicode characters.

  16. 

  17. In order to avoid the vulnerability, invalid values longer than

  18. ``UsernameField.max_length`` are no longer normalized, since they cannot pass

  19. validation anyway.
About Sign Up Leave Feedback Contact