CVE-2021-43794

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-610

Affected software

Vendor	Product	Versions
discourse	discourse	stable < 2.7.11; beta < 2.8.0.beta9; tests-passed < 2.8.0.beta9

References

https://github.com/discourse/discourse/commit/2da0001965c6d8632d723c46ea5df9f22a1a23f1Patch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-249g-pc77-65hpThird Party Advisory
https://github.com/discourse/discourse/commit/2da0001965c6d8632d723c46ea5df9f22a1a23f1Patch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-249g-pc77-65hpThird Party Advisory

Timeline

Published: Dec 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-437957.5Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond i CVE-2021-437976.5Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers CVE-2021-437987.5Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions CVE-2021-437999.8Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server pr CVE-2021-43809.8The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_aut CVE-2021-438007.5Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage CVE-2021-438017.5Mercurius is a GraphQL adapter for Fastify. Any users from Mercurius@8.10.0 to 8.11.1 are subjected to a denial of service attack by sending CVE-2021-438028.8Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file that, when imported, m CVE-2021-438037.5Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In o CVE-2021-438047.3PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2021-438057.5Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of se CVE-2021-438068.8Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does