Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-22740: Discourse vulnerable to Allocation of Resources Without Limits via Chat drafts

CVE-2023-22740 · published 3 years ago

Summary

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
discourse	discourse	<= 3.0.0 `cpe:2.3:a:discourse:discourse::::::::`

Original advisory text

Discourse vulnerable to Allocation of Resources Without Limits via Chat drafts

Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Allocation of Resources Without Limits. Users can create chat drafts of an unlimited length, which can cause a denial of service by generating an excessive load on the server. Additionally, an unlimited number of drafts were loaded when loading the user. This issue has been patched in version 2.1.0.beta1 (beta) and (tests-passed). Users should upgrade to the latest version where a limit has been introduced. There are no workarounds available.

References

https://github.com/discourse/discourse/security/advisories/GHSA-pwj4-rf62-p224 Vendor Advisory
https://github.com/discourse/discourse/commit/5eaf0802398ff06604f03b27a28dd274f2... Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22740... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-22740 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-770Allocation of Resources Without Limits

Timeline

Published27 Jan 2023

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2023-22740 · NVD

CVE-2023-22740 · OSV

GHSA-pwj4-rf62-p224 · GHSA

Track software like this

Free during beta