diff options
Diffstat (limited to 'docs/releases/6.0.2.txt')
| -rw-r--r-- | docs/releases/6.0.2.txt | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/docs/releases/6.0.2.txt b/docs/releases/6.0.2.txt index 8a694d4430..0cb1037f86 100644 --- a/docs/releases/6.0.2.txt +++ b/docs/releases/6.0.2.txt @@ -42,6 +42,18 @@ As a reminder, all untrusted user input should be validated before use. This issue has severity "high" according to the :ref:`Django security policy <security-disclosure>`. +CVE-2026-1285: Potential denial-of-service vulnerability in ``django.utils.text.Truncator`` HTML methods +======================================================================================================== + +``django.utils.text.Truncator.chars()`` and ``Truncator.words()`` methods (with +``html=True``) and the :tfilter:`truncatechars_html` and +:tfilter:`truncatewords_html` template filters were subject to a potential +denial-of-service attack via certain inputs with a large number of unmatched +HTML end tags, which could cause quadratic time complexity during HTML parsing. + +This issue has severity "moderate" according to the :ref:`Django security +policy <security-disclosure>`. + Bugfixes ======== |