Remote memory exhaustion via unbounded floatformat exponent

Denial of service in Django 4.2 before 4.2.15 and 5.0 before 5.0.8 allows remote attackers to exhaust memory via floatformat input. The floatformat filter converts scientific notation to Decimal and performs integer and fixed-point formatting without first bounding exponent magnitude, forcing allocation of an enormous digit sequence. Exposure requires an application to apply floatformat to an attacker-controlled string; successful requests can exhaust worker memory and interrupt service.