CVE-2025-68934: Discourse DoS Vulnerability

CVE-2025-68934 Overview

CVE-2025-68934 is an algorithmic complexity denial of service vulnerability affecting Discourse, a widely-deployed open source discussion platform. The vulnerability allows authenticated users to submit crafted payloads to the /drafts.json endpoint that cause O(n²) processing in the Base62.decode function, tying up workers for 35-60 seconds per request. This resource exhaustion attack affects all users of the platform as the shared worker pool becomes exhausted, effectively rendering the application unavailable.

Critical Impact

Authenticated attackers can exhaust the shared worker pool through algorithmic complexity attacks, causing denial of service for all platform users.

Affected Products

• Discourse versions prior to 3.5.4
• Discourse versions prior to 2025.11.2
• Discourse versions prior to 2025.12.1
• Discourse versions prior to 2026.1.0

Discovery Timeline

• 2026-01-28 - CVE-2025-68934 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2025-68934

Vulnerability Analysis

This vulnerability stems from an algorithmic complexity issue (CWE-770: Allocation of Resources Without Limits or Throttling) in Discourse's draft handling functionality. The Base62.decode function exhibits O(n²) time complexity when processing certain input patterns, allowing attackers to craft payloads that consume disproportionate processing resources relative to their size.

The attack targets the /drafts.json endpoint, which is accessible to all authenticated users. When a maliciously crafted payload is submitted, the Base62.decode function enters a computationally expensive code path that can tie up a worker process for 35-60 seconds per request. Since Discourse uses a shared worker pool to handle all incoming requests, sustained attacks can exhaust available workers and create a denial of service condition affecting all users on the platform.

The vulnerability is particularly concerning because it requires only basic authentication—any registered user can potentially launch this attack. Additionally, the max_draft_length site setting does not fully mitigate the issue, as payloads under the configured limit can still trigger the vulnerable code path.

Root Cause

The root cause is improper algorithmic design in the Base62.decode function, which exhibits quadratic time complexity O(n²) when processing certain input patterns. This creates an asymmetric resource consumption scenario where small, crafted inputs can consume significant server-side processing time. The lack of input validation or processing time limits on the drafts endpoint allows attackers to repeatedly exploit this inefficient code path.

Attack Vector

The attack is conducted over the network and requires low-privilege authenticated access to the Discourse platform. An attacker submits specially crafted payloads to the /drafts.json endpoint, each of which triggers the expensive Base62.decode processing path.

The vulnerability mechanism works as follows: The attacker constructs payloads that, while appearing valid to initial input checks, are specifically designed to maximize processing time in the Base62 decoding routine. Each malicious request can occupy a worker for up to 60 seconds. By sending multiple concurrent requests, an attacker can exhaust the worker pool, preventing legitimate users from accessing the platform. See the GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2025-68934

Indicators of Compromise

• Unusually long response times on the /drafts.json endpoint (35-60 seconds)
• High CPU utilization on Discourse worker processes with no corresponding increase in legitimate traffic
• Worker pool exhaustion logs or queued request warnings in Discourse logs
• Multiple rapid requests to /drafts.json from authenticated user accounts

Detection Strategies

• Monitor worker process execution time and alert on requests exceeding normal thresholds (e.g., >10 seconds)
• Implement rate limiting alerts on the /drafts.json endpoint to detect abnormal request patterns
• Set up application performance monitoring (APM) to track Base62 decode operations and flag anomalous processing times
• Review authentication logs for accounts making excessive draft-related API calls

Monitoring Recommendations

• Configure alerting for worker pool utilization exceeding 80% capacity
• Implement real-time monitoring of endpoint response times with specific attention to /drafts.json
• Enable detailed request logging for authenticated endpoints to support forensic analysis
• Monitor system resource metrics (CPU, memory) for sustained spikes correlating with draft API activity

How to Mitigate CVE-2025-68934

Immediate Actions Required

• Upgrade Discourse to version 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0 immediately
• Monitor worker pool health and response times for signs of active exploitation
• Consider implementing additional rate limiting on the /drafts.json endpoint as a temporary measure
• Review recent activity logs for suspicious patterns of draft submissions

Patch Information

Discourse has released patched versions that address this algorithmic complexity vulnerability. Organizations should upgrade to one of the following versions: 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0. The fix addresses the O(n²) complexity in the Base62.decode function. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Lowering the max_draft_length site setting can reduce the attack surface, though it does not fully mitigate the vulnerability as payloads under the limit can still trigger the slow code path
• Implement external rate limiting on the /drafts.json endpoint at the reverse proxy or WAF level
• Consider temporarily restricting draft functionality to trusted user groups until patches can be applied
• Deploy request timeout configurations at the application server level to terminate long-running requests

# Example: Configure nginx rate limiting for drafts endpoint
# Add to nginx configuration

limit_req_zone $binary_remote_addr zone=drafts_limit:10m rate=5r/m;

location /drafts.json {
    limit_req zone=drafts_limit burst=2 nodelay;
    proxy_pass http://discourse_upstream;
    proxy_read_timeout 30s;
}