PT-2026-5193 · Discourse · Discourse

Published 2026-01-28 · Updated 2026-02-02 · CVE-2025-68934

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0

Description Discourse is an open source discussion platform. Authenticated users can submit crafted payloads to the /drafts.json API endpoint that cause inefficient processing in the Base62.decode function. This results in a denial-of-service condition, tying up workers for 35-60 seconds per request and impacting all users due to exhaustion of the shared worker pool. The issue stems from O(n^2) complexity in the decoding process. Lowering the max draft length site setting reduces the attack surface but does not fully resolve the problem, as payloads under the limit can still trigger the slow code path.

Recommendations Update Discourse to version 3.5.4 or later. Update Discourse to version 2025.11.2 or later. Update Discourse to version 2025.12.1 or later. Update Discourse to version 2026.1.0 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-DISCOURSE-2025-68934

CVE-2025-68934

GHSA-VWJH-VRX9-9849

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68934.json · Exploit
• https://osv.dev/vulnerability/BIT-discourse-2025-68934 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68934 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68934 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-vwjh-vrx9-9849 · Note
• https://twitter.com/VulmonFeeds/status/2016714470030983277 · Twitter Post
• https://twitter.com/CVEnew/status/2016596620297552159 · Twitter Post
• https://t.me/CVEtracker/43167 · Telegram Post