Skip to content
CVE PROGRAM SOURCE RECORD4.9 Medium

CVE-2024-37299

Discourse vulnerable to DoS via Tag Group

Description

Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, crafting requests to submit very long tag group names can reduce the availability of a Discourse instance. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

discourse discourse

  • < 3.2.5affected
  • >= 3.3.0.beta1, < 3.3.0.beta5affected

References