Discourse CVE-2025-48053

CVSS 7.5 (High severity) with CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates this is a network-accessible denial-of-service vulnerability requiring no privileges and no user interaction, with significant real-world impact. The attack vector (Network), low complexity, and lack of required privileges make this highly exploitable. The availability impact is rated as 'High,' confirming substantial DoS potential. The absence of confidentiality and integrity impacts limits the risk profile to availability disruption. Without disclosed EPSS data or KEV status, this appears to be a moderate-to-high priority based on CVSS metrics alone; however, the practical impact depends on bot deployment frequency in Discourse instances and the computational cost of the malicious URL processing. The fact that patches have been released across multiple branches suggests the vulnerability was responsibly disclosed and is not actively exploited in the wild. Organizations running affected versions should prioritize patching to prevent resource exhaustion attacks.

An attacker identifies a public Discourse instance with bot users enabled (common for automated moderation, welcome messages, or integration tasks). The attacker crafts a malicious URL containing resource-intensive parameters (e.g., extremely large content, recursive redirects, or embedded binary data designed to trigger expensive parsing operations). The attacker sends this URL via PM to one or more bot users, either by creating an account or (if open registration is enabled) without authentication. When the bot processes the PM, it attempts to fetch or preview the URL, triggering the vulnerable code path that consumes excessive CPU, memory, or I/O resources without proper bounds. If multiple malicious URLs are sent in rapid succession to multiple bots, the cumulative resource consumption can degrade or exhaust server resources, causing the Discourse instance to become slow or unresponsive for legitimate users. The attacker requires only network access and the ability to send PMs (trivial on public instances), making this a practical DoS vector. No sophisticated exploitation tools are required; simple HTTP requests or UI interactions suffice.