CVE-2024-21655

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Jan 12, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-216584.3discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on regiCVE-2024-21666.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time MCVE-2024-216617.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploCVE-2024-216629.1Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effecCVE-2024-216638.8Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. DiscordCVE-2024-216647.5jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serCVE-2024-216654.3ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office ordeCVE-2024-216666.5The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management, segmentation, personalization and markeCVE-2024-216676.5pimcore/customer-data-framework is the Customer Management Framework for management of customer data within Pimcore. An authenticated and unCVE-2024-216684.9react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv lCVE-2024-216698.8Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mCVE-2024-216708.1Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a
CVE-2024-21655: Medium severity, CVSS 4.3 | Vulnix