[4.2.x] Fixed CVE-2024-41990 -- Mitigated potential DoS in urlize and urlizetrunc template filters.

Thanks to MProgrammer for the report.

1 files changed, 7 insertions, 0 deletions

diff --git a/docs/releases/4.2.15.txt b/docs/releases/4.2.15.txt
index f3fdb0a3cf..91d6d385e3 100644
--- a/docs/releases/4.2.15.txt
+++ b/docs/releases/4.2.15.txt
@@ -16,6 +16,13 @@ consumption.
 
 To avoid this, decimals with more than 200 digits are now returned as is.
 
+CVE-2024-41990: Potential denial-of-service vulnerability in ``django.utils.html.urlize()``
+===========================================================================================
+
+:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential
+denial-of-service attack via very large inputs with a specific sequence of
+characters.
+
 Bugfixes
 ========