From ecf1f8fb900f94de08c945164633e9a28a2edadb Mon Sep 17 00:00:00 2001
From: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
Date: Thu, 18 Jul 2024 13:19:34 +0200
Subject: Fixed CVE-2024-41990 -- Mitigated potential DoS in urlize and
 urlizetrunc template filters.

Thanks to MProgrammer for the report.
---
 docs/releases/4.2.15.txt | 7 +++++++
 docs/releases/5.0.8.txt  | 7 +++++++
 2 files changed, 14 insertions(+)

(limited to 'docs')

diff --git a/docs/releases/4.2.15.txt b/docs/releases/4.2.15.txt
index f3fdb0a3cf..91d6d385e3 100644
--- a/docs/releases/4.2.15.txt
+++ b/docs/releases/4.2.15.txt
@@ -16,6 +16,13 @@ consumption.
 
 To avoid this, decimals with more than 200 digits are now returned as is.
 
+CVE-2024-41990: Potential denial-of-service vulnerability in ``django.utils.html.urlize()``
+===========================================================================================
+
+:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential
+denial-of-service attack via very large inputs with a specific sequence of
+characters.
+
 Bugfixes
 ========
 
diff --git a/docs/releases/5.0.8.txt b/docs/releases/5.0.8.txt
index c371e4af0b..7de9bb9de1 100644
--- a/docs/releases/5.0.8.txt
+++ b/docs/releases/5.0.8.txt
@@ -16,6 +16,13 @@ consumption.
 
 To avoid this, decimals with more than 200 digits are now returned as is.
 
+CVE-2024-41990: Potential denial-of-service vulnerability in ``django.utils.html.urlize()``
+===========================================================================================
+
+:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential
+denial-of-service attack via very large inputs with a specific sequence of
+characters.
+
 Bugfixes
 ========
 
-- 
cgit v1.3