CVE-2022-23641

Denial of Service in Discourse

Discourse is an open source discussion platform. In versions prior to 2.8.1 in the `stable` branch, 2.9.0.beta2 in the `beta` branch, and 2.9.0.beta2 in the `tests-passed` branch, users can trigger a Denial of Service attack by posting a streaming URL. Parsing Oneboxes in the background job trigger an infinite loop, which cause memory leaks. This issue is patched in version 2.8.1 of the `stable` branch, 2.9.0.beta2 of the `beta` branch, and 2.9.0.beta2 of the `tests-passed` branch. As a workaround, disable onebox in admin panel completely or specify allow list of domains that will be oneboxed.

We have discovered 375 live websites that are affected by CVE-2022-23641.

Run a Free Instant Scan



Affected Software

Product  Discourse
Category Message Boards
Vulnerable Domains375 live websites (8.95% of Discourse install base)
Vulnerable Versions
  • from 0 through 2.8.1
Vulnerable Versions Count18 versions ( 25% of all versions)


Common Weakness Enumeration

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')



Details

  • Published - Feb 15, 2022
  • Updated - Apr 23, 2025

Website Distribution by Country

Number of websites using CVE-2022-23641
United States240 websites


Germany39 websites
France19 websites
China9 websites
Singapore8 websites
Brazil7 websites
GB4 websites
Russia4 websites
Italy3 websites
Switzerland3 websites

Website Distribution by TLD

Number of websites using CVE-2022-23641
.com159 websites
.org64 websites
.io18 websites
.net15 websites
.de11 websites
.co7 websites
.fr5 websites
.it4 websites
.cn4 websites
.com.br4 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2022-23641

Top websites that are affected by CVE-2022-23641. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
******.********.com United States**,***
*****.***********.com United States***,***
*************.com United States***,***
*****.com United States***,***
*****.***.io United States***,***
*****.**********.org Switzerland***,***
******.********.com United States***,***
******.*******.org United States***,***
*********.****************.com United States***,***
*****.*****.org China***,***
See full domain list

FAQ

CVE-2022-23641 is Loop with Unreachable Exit Condition ('Infinite Loop') in Discourse
A total of 375 websites have been identified as vulnerable to CVE-2022-23641, based on global website indexing conducted by WebTechSurvey.
The Discourse is affected by the CVE-2022-23641 vulnerability.
Discourse versions up to and including 2.8.1 are vulnerable to CVE-2022-23641.