Django 4.2.21 release notes

Expected May 7, 2025

Django 4.2.21 fixes a security issue with severity “moderate”, a data loss bug, and a regression in 4.2.20.

CVE-2025-32873: Denial-of-service possibility in strip_tags()

strip_tags() would be slow to evaluate certain inputs containing large sequences of incomplete HTML tags. This function is used to implement the striptags template filter, which was thus also vulnerable.

strip_tags() now raises a SuspiciousOperation exception if it encounters an unusually large number of unclosed opening tags.

Bugfixes

  • Fixed a data corruption possibility in file_move_safe() when allow_overwrite=True, where leftover content from a previously larger file could remain after overwriting with a smaller one due to lack of truncation (#36298).
  • Fixed a regression in Django 4.2.20, introduced when fixing CVE-2025-26699, where the wordwrap template filter did not preserve empty lines between paragraphs after wrapping text (#36341).
« previous | up | next »