Skip to content
OpenAdvisories
Medium · 4.9 CVE-2024-37299 EUVD-2024-36564

Discourse vulnerable to DoS via Tag Group

Published Jul 30, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Description

Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, crafting requests to submit very long tag group names can reduce the availability of a Discourse instance. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.

Affected products

VendorProductAffectedFixed
discourse discourse < 3.2.5, >= 3.3.0.beta1, < 3.3.0.beta5 —

References