Django 4.2.21 release notes

May 7, 2025

Django 4.2.21 fixes a security issue with severity “moderate”, a data loss bug, and a regression in 4.2.20.

This release was built using an upgraded setuptools, producing filenames compliant with PEP 491 and PEP 625 and thus addressing a PyPI warning about non-compliant distribution filenames. This change only affects the Django packaging process and does not impact Django’s behavior.

CVE-2025-32873: Denial-of-service possibility in strip_tags()

strip_tags() would be slow to evaluate certain inputs containing large sequences of incomplete HTML tags. This function is used to implement the striptags template filter, which was thus also vulnerable.

strip_tags() now raises a SuspiciousOperation exception if it encounters an unusually large number of unclosed opening tags.

Bugfixes

• Fixed a data corruption possibility in file_move_safe() when allow_overwrite=True, where leftover content from a previously larger file could remain after overwriting with a smaller one due to lack of truncation (#36298).

• Fixed a regression in Django 4.2.20, introduced when fixing CVE 2025-26699, where the wordwrap template filter did not preserve empty lines between paragraphs after wrapping text (#36341).