CVE-2023-22740

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Allocation of Resources Without Limits. Users can create chat drafts of an unlimited length, which can cause a denial of service by generating an excessive load on the server. Additionally, an unlimited number of drafts were loaded when loading the user. This issue has been patched in version 2.1.0.beta1 (beta) and (tests-passed). Users should upgrade to the latest version where a limit has been introduced. There are no workarounds available.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Jan 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-227419.8Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. In affected versions Sofia-SIP **lacks bo CVE-2023-227425.9libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 doe CVE-2023-227437.3Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL a CVE-2023-227456.4tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2 CVE-2023-227467.5CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of t CVE-2023-227479.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-227489.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-227499.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-22755.4The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data du CVE-2023-227509.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-227519.8There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted CVE-2023-227529.8There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted