VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Jan 12, 2024· Updated Jun 17, 2026

CVE-2024-21655

CVE-2024-21655

Description

Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7
  • Discourse (software)/Discourse6 versions
    cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*+ 5 more
    • cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*range: <3.1.4
    • cpe:2.3:a:discourse:discourse:3.2.0:beta1:*:*:beta:*:*:*
    • cpe:2.3:a:discourse:discourse:3.2.0:beta2:*:*:beta:*:*:*
    • cpe:2.3:a:discourse:discourse:3.2.0:beta3:*:*:beta:*:*:*
    • (no CPE)range: before 3.1.4 and before 3.2.0.beta4
    • (no CPE)range: < 3.1.4
  • osv-coords
    pkg:bitnami/discourse
    Range: < 3.1.4

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.