Description (CNA)
Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` branches, parsing posts can be susceptible to regular expression denial of service (ReDoS) attacks. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| discourse / discourse | affected < 2.8.14; affected >= 2.9.0.beta0, < 2.9.0.beta16 |
CWE
CWE-1333
References
- https://github.com/discourse/discourse/security/advisories/GHSA-7rw2-f4x7-7pxf
- https://github.com/discourse/discourse/pull/19737
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.