CVE-2024-37299: Discourse vulnerable to DoS via Tag Group
Published Jul 30, 2024
·Updated
Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, crafting requests to submit very long tag group names can reduce the availability of a Discourse instance. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.
Affected Software
5 affected components
Discourse Discourse<3.2.5
Discourse Discourse=3.3.0-beta1
Discourse Discourse=3.3.0-beta2
Discourse Discourse=3.3.0-beta3
Discourse Discourse=3.3.0-beta4
Remediation
Event History
Jul 30, 2024
CVE Published
via MITRE·02:22 PM
Data Sourced
via MITRE·02:22 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-37299?
CVE-2024-37299 has a moderate severity level as it can impact the availability of a Discourse instance.
2
How do I fix CVE-2024-37299?
To fix CVE-2024-37299, update your Discourse installation to version 3.2.5 or later, or to 3.3.0.beta5 or later.
3
What versions are affected by CVE-2024-37299?
CVE-2024-37299 affects Discourse versions prior to 3.2.5 and versions 3.3.0.beta1 through 3.3.0.beta4.
4
What type of attack does CVE-2024-37299 involve?
CVE-2024-37299 involves crafting requests with excessively long tag group names.
5
What impact can CVE-2024-37299 have on my Discourse instance?
CVE-2024-37299 can reduce the availability of your Discourse instance, potentially leading to downtime.