PT-2024-27959 · Discourse · Discourse

Nattsw · Published 2024-07-15 · Updated 2025-08-26 · CVE-2024-38360

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.2.3

Description Discourse is an open source platform for community discussion. In affected versions, by creating replacement words with an almost unlimited number of characters, a moderator can reduce the availability of a Discourse instance.

Recommendations For versions prior to 3.2.3, upgrade to stable version 3.2.3 or a current beta to address the issue. As a temporary workaround for users unable to upgrade, manually remove the long watched words either via SQL or Rails console.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BIT-DISCOURSE-2024-38360

CVE-2024-38360

GHSA-68PM-HM8X-PQ2P

Affected Products

Discourse

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38360.json · Exploit
• https://github.com/discourse/discourse/commit/7b53e610c17e38be982dffefa4e5b5a709a3b990 · Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-68pm-hm8x-pq2p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-38360 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38360 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2024-38360 · Vendor Advisory
• https://t.me/cvenotify/86274 · Telegram Post
• https://t.me/cvedetector/906 · Telegram Post
• https://t.me/cveNotify/133553 · Telegram Post