Fixed CVE-2024-45230 -- Mitigated potential DoS in urlize and urlizetrunc template filters.

Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report.

docs/ref/templates/builtins.txt

@@ -2922,6 +2922,17 @@ Django's built-in :tfilter:`escape` filter. The default value for
     email addresses that contain single quotes (``'``), things won't work as
     expected. Apply this filter only to plain text.
 
+.. warning::
+
+    Using ``urlize`` or ``urlizetrunc`` can incur a performance penalty, which
+    can become severe when applied to user controlled values such as content
+    stored in a :class:`~django.db.models.TextField`. You can use
+    :tfilter:`truncatechars` to add a limit to such inputs:
+
+    .. code-block:: html+django
+
+        {{ value|truncatechars:500|urlize }}
+
 .. templatefilter:: urlizetrunc
 
 ``urlizetrunc``

docs/releases/4.2.16.txt

@@ -7,4 +7,9 @@ Django 4.2.16 release notes
 Django 4.2.16 fixes one security issue with severity "moderate" and one
 security issue with severity "low" in 4.2.15.
 
-...
+CVE-2024-45230: Potential denial-of-service vulnerability in ``django.utils.html.urlize()``
+===========================================================================================
+
+:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential
+denial-of-service attack via very large inputs with a specific sequence of
+characters.

docs/releases/5.0.9.txt

@@ -7,4 +7,9 @@ Django 5.0.9 release notes
 Django 5.0.9 fixes one security issue with severity "moderate" and one security
 issue with severity "low" in 5.0.8.
 
-...
+CVE-2024-45230: Potential denial-of-service vulnerability in ``django.utils.html.urlize()``
+===========================================================================================
+
+:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential
+denial-of-service attack via very large inputs with a specific sequence of
+characters.

docs/releases/5.1.1.txt

@@ -7,6 +7,13 @@ Django 5.1.1 release notes
 Django 5.1.1 fixes one security issue with severity "moderate", one security
 issue with severity "low", and several bugs in 5.1.
 
+CVE-2024-45230: Potential denial-of-service vulnerability in ``django.utils.html.urlize()``
+===========================================================================================
+
+:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential
+denial-of-service attack via very large inputs with a specific sequence of
+characters.
+
 Bugfixes
 ========