1. ==========================

  2. Django 4.1.6 release notes

  3. ==========================

  4. 

  5. *February 1, 2023*

  6. 

  7. Django 4.1.6 fixes a security issue with severity "moderate" and a bug in

  8. 4.1.5.

  9. 

  10. CVE-2023-23969: Potential denial-of-service via ``Accept-Language`` headers

  11. ===========================================================================

  12. 

  13. The parsed values of ``Accept-Language`` headers are cached in order to avoid

  14. repetitive parsing. This leads to a potential denial-of-service vector via

  15. excessive memory usage if large header values are sent.

  16. 

  17. In order to avoid this vulnerability, the ``Accept-Language`` header is now

  18. parsed up to a maximum length.

  19. 

  20. Bugfixes

  21. ========

  22. 

  23. * Fixed a bug in Django 4.1 that caused a crash of model validation on

  24.   ``UniqueConstraint`` with ordered expressions (:ticket:`34291`).
About Sign Up Leave Feedback Contact