CVE-2024-43789

Denial of service by the absence of restrictions on replies to posts in Discourse

State: Published
Severity: 7.5 High
Published: Oct 7, 2024
Updated: Oct 8, 2024
Reserved: Aug 16, 2024

Description

Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them all at once. This can potentially reduce the availability of a Discourse instance. This problem has been patched in the latest version of Discourse. All users area are advised to upgrade. There are no known workarounds for this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
discoursediscourse	stable: < 3.3.1Affected beta: < 3.4.0.beta1Affected

References

https://github.com/discourse/discourse/security/advisories/GHSA-62cq-cpmc-hvqq

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.