CVE-2025-68934 json
Discourse Has Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint
published 2026-01-28 9 mo ago modified 2026-09-08 2 mo ago also BIT-discourse-2025-68934 , EUVD-2025-206443 , GHSA-vwjh-vrx9-9849
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, authenticated users can submit crafted payloads to /drafts.json that cause O(n^2) processing in Base62.decode, tying up workers for 35-60 seconds per request. This affects all users as the shared worker pool becomes exhausted. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. Lowering the max_draft_length site setting reduces attack surface but does not fully mitigate the issue, as payloads under the limit can still trigger the slow code path.
Patch / fix
- bitnami discourse 3.5.4, 2025.11.2, 2026.1.0
- discourse discourse 3.5.4, 2025.11.2, 2026.1.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | discourse | <3.5.4 >=2025.11.0, <2025.11.2 >=2025.12.0, <2026.1.0 |
3.5.4 2025.11.2 2026.1.0 |
Affected products
- discourse discourse
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/discourse/discourse/security/advisories/GHSA-vwjh-vrx9-9849
mitigation, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-68934
web
Sources
- CVE List CVE-2025-68934
- NVD CVE-2025-68934
- OSV BIT-discourse-2025-68934
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.