Discourse vulnerable to ReDoS in user agent parsing

CVE-2023-23621

What is CVE-2023-23621?

Discourse, the open-source discussion platform, is affected by a vulnerability that permits a malicious individual to exploit the system through a specially crafted user agent, leading to a regular expression denial of service. This vulnerability impacts versions before 3.0.1 on the stable branch and 3.1.0.beta2 on the beta and tests-passed branches. The flaw has been patched in the specified versions, ensuring the platform's security against this type of attack, which can degrade service availability.

References