CVE-2024-21655: Discourse

Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days.

Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4.

Affected products

• Discourse Discourse: before 3.1.4 (fixed in 3.1.4); version 3.2.0 only

Published 2024-01-12. Last modified 2026-06-17.