Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/plugins/poll/assets
History
Exact
discoursebot 561c4e746c
 SECURITY: Uncontrolled Resource Consumption in Number Poll Generation [backport 2026.1] (#41151) 
Backport of #41141 to release/2026.1.

---

## Summary

The markdown engine generates poll options in an unbounded loop based on
user input, enabling an attacker to trigger massive memory allocation
and CPU usage in the V8 process. This blocks a global mutex and can
cause worker crashes, effectively DoS-ing markdown processing for all
users.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1120
- HackerOne report: https://hackerone.com/reports/3598542

---

🤖 Auto-generated from the patch diff via Patch Triage. Review carefully
before merging.

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Sam <sam.saffron@gmail.com>
Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-06-24 15:53:17 +10:00
..
javascripts SECURITY: Uncontrolled Resource Consumption in Number Poll Generation [backport 2026.1] (#41151) 2026-06-24 15:53:17 +10:00
stylesheets FIX: Add local date support in poll options and improve rich editor date formatting (#36718) 2025-12-18 13:30:42 +01:00