CVE-2022-23641

Discourse is an open source discussion platform. In versions prior to 2.8.1 in the `stable` branch, 2.9.0.beta2 in the `beta` branch, and 2.9.0.beta2 in the `tests-passed` branch, users can trigger a Denial of Service attack by posting a streaming URL. Parsing Oneboxes in the background job trigger an infinite loop, which cause memory leaks. This issue is patched in version 2.8.1 of the `stable` branch, 2.9.0.beta2 of the `beta` branch, and 2.9.0.beta2 of the `tests-passed` branch. As a workaround, disable onebox in admin panel completely or specify allow list of domains that will be oneboxed.

• CWE-835
• CWE-835

• https://github.com/discourse/discourse/commit/a34075d205a8857e29574ffd82aaece0c467565ePatch, Third Party Advisory
• https://github.com/discourse/discourse/pull/15927Patch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-22xw-f62v-cfxvIssue Tracking, Third Party Advisory
• https://github.com/discourse/discourse/commit/a34075d205a8857e29574ffd82aaece0c467565ePatch, Third Party Advisory
• https://github.com/discourse/discourse/pull/15927Patch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-22xw-f62v-cfxvIssue Tracking, Third Party Advisory

Published

Feb 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23636Wasmtime is an open source runtime for WebAssembly & WASI. P…8.1
• CVE-2022-23637K-Box is a web-based application to manage documents, images…5.4
• CVE-2022-23638svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross…6.1
• CVE-2022-23639crossbeam-utils provides atomics, synchronization primitives…8.1
• CVE-2022-2364A vulnerability, which was classified as problematic, was fo…5.4
• CVE-2022-23640Excel-Streaming-Reader is an easy-to-use implementation of a…9.8
• CVE-2022-23642Sourcegraph is a code search and navigation engine. Sourcegr…8.8
• CVE-2022-23643Sourcegraph is a code search and navigation engine. Sourcegr…6.5
• CVE-2022-23644BookWyrm is a decentralized social network for tracking read…8.8
• CVE-2022-23645swtpm is a libtpms-based TPM emulator with socket, character…5.5
• CVE-2022-23646Next.js is a React framework. Starting with version 10.0.0 a…7.5
• CVE-2022-23647Prism is a syntax highlighting library. Starting with versio…6.1