CVE-2023-38684

Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, in multiple controller actions, Discourse accepts limit params but does not impose any upper bound on the values being accepted. Without an upper bound, the software may allow arbitrary users to generate DB queries which may end up exhausting the resources on the server. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability.

• CWE-770

• https://github.com/discourse/discourse/commit/bfc3132bb22bd5b7e86f428746b89c4d3d7f5a70Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-ff7g-xv79-hgmfVendor Advisory
• https://github.com/discourse/discourse/commit/bfc3132bb22bd5b7e86f428746b89c4d3d7f5a70Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-ff7g-xv79-hgmfVendor Advisory

Published

Jul 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38678OOB access in paddle.mode in PaddlePaddle before 2.6.0. This…7.5
• CVE-2023-38679A vulnerability has been identified in Tecnomatix Plant Simu…7.8
• CVE-2023-38680A vulnerability has been identified in Tecnomatix Plant Simu…7.8
• CVE-2023-38681A vulnerability has been identified in Tecnomatix Plant Simu…7.8
• CVE-2023-38682A vulnerability has been identified in JT2Go (All versions <…7.8
• CVE-2023-38683A vulnerability has been identified in JT2Go (All versions <…7.8
• CVE-2023-38685Discourse is an open source discussion platform. Prior to ve…4.3
• CVE-2023-38686Sydent is an identity server for the Matrix communications p…5.3
• CVE-2023-38687Svelecte is a flexible autocomplete/select component written…5.4
• CVE-2023-38688twitch-tui provides Twitch chat in a terminal. Prior to vers…7.5
• CVE-2023-38689Logistics Pipes is a modification (a.k.a. mod) for the compu…9.8
• CVE-2023-3869The wpDiscuz plugin for WordPress is vulnerable to unauthori…5.3