CVE-2025-68659

Discourse has DoS vulnerability in username change endpoint

State: Published
Severity: 4.3 Medium
Published: Jan 28, 2026
Updated: Jan 28, 2026
Reserved: Dec 22, 2025

Description

Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have an application level denial of service vulnerabilityin the username change functionality at try.discourse.org. The vulnerability allows attackers to cause noticeable server delays and resource exhaustion by sending large JSON payloads to the username preference endpoint PUT /u//preferences/username, resulting in degraded performance for other users and endpoints. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L	GitHub_M

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
discoursediscourse	< 3.5.4Affected >= 2025.11.0-latest, < 2025.11.2Affected >= 2025.12.0-latest, < 2025.12.1Affected >= 2026.1.0-latest, < 2026.1.0Affected

References

https://github.com/discourse/discourse/security/advisories/GHSA-rmp6-c9rq-6q7p

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.