CVE-2023-47120

Date: November 10, 2023

Discourse is an open source platform for community discussion. In versions 3.1.0 through 3.1.2 of the "stable" branch and versions 3.1.0,beta6 through 3.2.0.beta2 of the "beta" and "tests-passed" branches, Redis memory can be depleted by crafting a site with an abnormally long favicon URL and drafting multiple posts which Onebox it. The issue is patched in version 3.1.3 of the "stable" branch and version 3.2.0.beta3 of the "beta" and "tests-passed" branches. There are no known workarounds.

Language: Ruby