Django 5.2.2 release notes

June 4, 2025

Django 5.2.2 fixes a security issue with severity “low” and several bugs in 5.2.1.

CVE-2025-48432: Potential log injection via unescaped request path

Internal HTTP response logging used request.path directly, allowing control characters (e.g. newlines or ANSI escape sequences) to be written unescaped into logs. This could enable log injection or forgery, letting attackers manipulate log appearance or structure, especially in logs processed by external systems or viewed in terminals.

Although this does not directly impact Django’s security model, it poses risks when logs are consumed or interpreted by other tools. To fix this, the internal django.utils.log.log_response() function now escapes all positional formatting arguments using a safe encoding.

Bugfixes

• Fixed a crash when using select_related against a ForeignObject originating from a model with a CompositePrimaryKey (#36373).

• Fixed a bug in Django 5.2 where subqueries using "pk" to reference models with a CompositePrimaryKey failed to raise ValueError when too many or too few columns were selected (#36392).

• Fixed a regression in Django 5.2 that caused a crash when no arguments were passed into QuerySet.union() (#36388).

• Fixed a regression in Django 5.2 where subclasses of RemoteUserMiddleware that had overridden process_request() were no longer supported (#36390).

• Fixed a regression in Django 5.2 that caused a crash when using OuterRef in the filter argument of an Aggregate expression (#36404).

• Fixed a regression in Django 5.2 that caused a crash when using OuterRef in PostgreSQL aggregate functions ArrayAgg, StringAgg, and JSONBAgg (#36405).

• Fixed a regression in Django 5.2 where admin’s filter_horizontal buttons lacked type="button", causing them to intercept form submission when pressing the Enter key (#36423).

• Fixed a bug in Django 5.2 where calling QuerySet.in_bulk() with an id_list argument on models with a CompositePrimaryKey failed to observe database parameter limits (#36416).

• Fixed a bug in Django 5.2 where HttpRequest.get_preferred_type() did not account for media type parameters in Accept headers, reducing specificity in content negotiation (#36411).

• Fixed a regression in Django 5.2 that caused a crash when using QuerySet.prefetch_related() to prefetch a foreign key with a Prefetch queryset for a subclass of the foreign target (#36432).