CVE-2022-41921

MEDIUM4.3EPSS 0.31%

Discourse chat messages should have a maximum character limit

Published: 3/6/2024Modified: 10/14/2025

Also known as:GHSA-mfh7-6cv6-qcccBIT-discourse-2022-41921

Description

Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial of service for other users when posting huge amounts of text. Users should upgrade to version 2.9.0.beta13, where a limit has been introduced. No known workarounds are available.

Affected packages (1)

Bitnami/discoursefrom 0, < 2.9.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References (3)

WEBhttps://github.com/discourse/discourse/commit/3de765c89524a526ce611e11468d758a471a933f
WEBhttps://github.com/discourse/discourse/security/advisories/GHSA-mfh7-6cv6-qccc
WEBhttps://nvd.nist.gov/vuln/detail/CVE-2022-41921