PT-2026-5183 · Discourse · Discourse

Published 2026-01-28 · Updated 2026-02-02 · CVE-2025-68659

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0

Description Discourse, an open source discussion platform, is subject to an application-level denial of service. The issue resides in the username change functionality, specifically when handling large JSON payloads sent to the username preference endpoint. Attackers can exploit this by submitting substantial JSON data to the PUT /u//preferences/username API endpoint, causing server delays and resource exhaustion. This can lead to degraded performance for other users and endpoints.

Recommendations Update Discourse to version 3.5.4 or later. Update Discourse to version 2025.11.2 or later. Update Discourse to version 2025.12.1 or later. Update Discourse to version 2026.1.0 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-DISCOURSE-2025-68659

CVE-2025-68659

GHSA-RMP6-C9RQ-6Q7P

Affected Products

Discourse

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68659.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-68659 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2025-68659 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68659 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-rmp6-c9rq-6q7p · Note
• https://twitter.com/CVEnew/status/2016587739789983799 · Twitter Post