All vulnerabilities

Servers and applications

CVE-2022-39226

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a malicious actor can add large payloads of text into the Location and Website fields of a user profile, which causes issues for other users when loading that profile. A fix to limit the length of user input for these fields is…

Severity
Medium 4.3
Published
29 Sept 2022
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
2.8.9
Sources
NVD

Affected software

SoftwareAffected versions
DiscourseServers and applications · cpe:a:discourse:discourse
  • Version 2.9.0-beta9
  • Version 2.9.0-beta8
  • Version 2.9.0-beta7
  • Version 2.9.0-beta6
All 10 release lines
  • Every version before 2.8.9
  • Version 2.9.0-beta1
  • Version 2.9.0-beta2
  • Version 2.9.0-beta3
  • Version 2.9.0-beta4
  • Version 2.9.0-beta5
  • Version 2.9.0-beta6
  • Version 2.9.0-beta7
  • Version 2.9.0-beta8
  • Version 2.9.0-beta9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-39226
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-39226