CVE-2023-41042

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. There are no known workarounds.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
discourse	discourse	stable < 3.1.1; beta < 3.2.0.beta1; tests-passed < 3.2.0.beta1

References

https://github.com/discourse/discourse/security/advisories/GHSA-2fq5-x3mm-v254Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-2fq5-x3mm-v254Third Party Advisory

Timeline

Published: Sep 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-410436.5Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `te CVE-2023-410443.8Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's `Support Bundle` feature. The CVE-2023-410455.3Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single CVE-2023-410466.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute CVE-2023-410476.5OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious CVE-2023-410485.4plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions CVE-2023-410496.1@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in CVE-2023-41054.3Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and downloa CVE-2023-410507.7AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format s CVE-2023-410514.7In a typical Virtual Machine Monitor (VMM) there are several components, such as boot loader, virtual device drivers, virtio backend drivers CVE-2023-410525.3Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256 CVE-2023-410533.3Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant