Discourse vulnerable to unlimited mentioned users in message serializer

CVE-2023-48297

What is CVE-2023-48297?

A vulnerability has been identified in Discourse, a platform designed for community discussions, specifically related to its message serialization functionality. The issue arises when the system processes chat mentions like @all and @here, which can lead to a significantly long array of users being included. This has the potential to create performance issues or exploitative scenarios within the application. The vulnerability has been addressed in the updates provided in versions 3.1.4 and beta 3.2.0.beta5.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References