CVE-2022-23641

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-23641
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23641.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-23641
Aliases
Published
2022-02-15T20:15:11Z
Modified
2026-10-21T02:47:46Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Denial of Service in Discourse
Details

Discourse is an open source discussion platform. In versions prior to 2.8.1 in the stable branch, 2.9.0.beta2 in the beta branch, and 2.9.0.beta2 in the tests-passed branch, users can trigger a Denial of Service attack by posting a streaming URL. Parsing Oneboxes in the background job trigger an infinite loop, which cause memory leaks. This issue is patched in version 2.8.1 of the stable branch, 2.9.0.beta2 of the beta branch, and 2.9.0.beta2 of the tests-passed branch. As a workaround, disable onebox in admin panel completely or specify allow list of domains that will be oneboxed.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-835"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23641.json"
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
3a5b75435ecc240877608d54dfc1490734f2e640
Fixed
a34075d205a8857e29574ffd82aaece0c467565e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "stable <= 2.8.0"
                },
                {
                    "last_affected":  "stable <= 2.8.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "beta <= 2.9.0.beta1"
                },
                {
                    "last_affected":  "beta <= 2.9.0.beta1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "tests-passed <= 2.9.0.beta1"
                },
                {
                    "last_affected":  "tests-passed <= 2.9.0.beta1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "a34075d205a8857e29574ffd82aaece0c467565e"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

beta <= 2.*
beta <= 2.9.0.beta1
stable <= 2.*
stable <= 2.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23641.json"