CVE-2023-41043

MEDIUM

Discourse <3.1.1, <3.2.0.beta1 - DoS

Title source: llm
STIX 2.1

Description

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious admin could create extremely large icons sprites, which would then be cached in each server process. This may cause server processes to be killed and lead to downtime. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. This is only a concern for multisite installations. No action is required when the admins are trusted.

References (1)

Core 1
Core References

Scores

CVSS v3 6.5
EPSS 0.0009
EPSS Percentile 25.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-770
Status published
Products (5)
discourse/discourse 1.1.0 beta1 (9 CPE variants)
discourse/discourse 1.2.0 beta1 (9 CPE variants)
discourse/discourse 1.3.0 beta1 (11 CPE variants)
discourse/discourse 1.4.0 beta1 (12 CPE variants)
discourse/discourse 1.5.0 beta1 (9 CPE variants)
Published Sep 15, 2023
Tracked Since Feb 18, 2026