CVE-2022-23549

Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` branches, users can create posts with raw body longer than the `max_length` site setting by including html comments that are not counted toward the character limit. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds.

• CWE-20

• https://github.com/discourse/discourse/commit/bf6b08670a927cc80bb090b7a2e710b4b554e6a8Patch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-p47g-v5wr-p4xpThird Party Advisory
• https://github.com/discourse/discourse/commit/bf6b08670a927cc80bb090b7a2e710b4b554e6a8Patch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-p47g-v5wr-p4xpThird Party Advisory

Published

Jan 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23542OpenFGA is an authorization/permission engine built for deve…9.8
• CVE-2022-23543Silverware Games is a social network where people can play g…5.4
• CVE-2022-23544MeterSphere is a one-stop open source continuous testing pla…6.1
• CVE-2022-23546In version 2.9.0.beta14 of Discourse, an open-source discuss…5.5
• CVE-2022-23547PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2022-23548Discourse is an option source discussion platform. Prior to …6.5
• CVE-2022-2355The Easy Username Updater WordPress plugin before 1.0.5 does…6.5
• CVE-2022-23551aad-pod-identity assigns Azure Active Directory identities t…5.3
• CVE-2022-23552Grafana is an open-source platform for monitoring and observ…5.4
• CVE-2022-23553Alpine is a scaffolding library in Java. Alpine prior to ver…7.5
• CVE-2022-23554Alpine is a scaffolding library in Java. Alpine prior to ver…5.4
• CVE-2022-23555authentik is an open-source Identity Provider focused on fle…8.8