UpHeron
All vulnerabilities

Servers and applications

CVE-2025-68659

Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have an application level denial of service vulnerabilityin the username change functionality at try.discourse.org. The vulnerability allows attackers to cause noticeable server delays and resource exhaustion by sending large JSON payloads to the username preference endpoint PUT…

Severity
Medium 5.3
Published
28 Jan 2026
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.5.4, 2025.11.2
Sources
NVD

Affected software

SoftwareAffected versions
DiscourseServers and applications · cpe:a:discourse:discourse
  • Every version before 3.5.4
  • From 2025.11.0 before 2025.11.2
  • Version 2025.12.0
  • Version 2026.1.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-68659
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-68659