CVE-2025-48053CWE-400CWE-770

Discourse vulnerable to DoS via large URL payload in PM to a bot

High · published June 9, 2025

CVSS v4.0
8.7
EPSS
0%
Percentile
29.7
In the wild
Unconfirmed
What it is

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, sending a malicious URL in a PM to a bot user can cause a reduced the availability of a Discourse instance. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. No known workarounds are available.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00370 · 29.7th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2025-06-09T12:30Z
EPSS history
Timeline
  • 09 JUN 12:30Z
    Discourse vulnerable to DoS via large URL payload in PM to a bot
    cvelistv5