CVE-2015-0222: Django database denial-of-service with ModelMultipleChoiceField

The vulnerability stems from duplicate value handling in ModelMultipleChoiceField validation. The pre-patch code in clean() and to_python() methods processed each submitted value individually, including duplicates. The GitHub commit shows these methods were modified to call a new _check_values() method that deduplicates inputs using frozenset(). The lack of deduplication in the original implementations directly enabled the SQL query amplification attack described in CVE-2015-0222. The file path and function names are explicitly shown in the commit diff, and the vulnerability documentation specifically references ModelMultipleChoiceField validation logic.