CVE-2023-22740

Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Allocation of Resources Without Limits. Users can create chat drafts of an unlimited length, which can cause a denial of service by generating an excessive load on the server. Additionally, an unlimited number of drafts were loaded when loading the user. This issue has been patched in version 2.1.0.beta1 (beta) and (tests-passed). Users should upgrade to the latest version where a limit has been introduced. There are no workarounds available.

• CWE-770

• https://github.com/discourse/discourse/commit/5eaf0802398ff06604f03b27a28dd274f2ffa576Patch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-pwj4-rf62-p224Third Party Advisory
• https://github.com/discourse/discourse/commit/5eaf0802398ff06604f03b27a28dd274f2ffa576Patch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-pwj4-rf62-p224Third Party Advisory

Published

Jan 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22735Zulip is an open-source team collaboration tool. In versions…4.6
• CVE-2023-22736Argo CD is a declarative, GitOps continuous delivery tool fo…8.5
• CVE-2023-22737wire-server provides back end services for Wire, a team comm…6.5
• CVE-2023-22738vantage6 is a privacy preserving federated learning infrastr…6.5
• CVE-2023-22739Discourse is an open source platform for community discussio…6.5
• CVE-2023-2274Rejected reason: This CVE assignment was considered invalid …
• CVE-2023-22741Sofia-SIP is an open-source SIP User-Agent library, complian…9.8
• CVE-2023-22742libgit2 is a cross-platform, linkable library implementation…5.9
• CVE-2023-22743Git for Windows is the Windows port of the revision control …7.3
• CVE-2023-22745tpm2-tss is an open source software implementation of the Tr…6.4
• CVE-2023-22746CKAN is an open-source DMS (data management system) for powe…7.5
• CVE-2023-22747There are multiple command injection vulnerabilities that co…9.8