GHSA-x7gm-rfgv-w973 Potential DoS with NumberFilter conversion to integer values.

• PyPI django-filter: < 2.4.0 → fixed in 2.4.0

Impact Automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Patches Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Workarounds Users may manually apply an equivalent validator if they are not able to upgrade. For more information If you have any questions or comments about this advisory: • Open an issue in the django-filter repo Thanks to Marcin Waraksa for the report.