Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-11 02:59:07 +08:00
Code Packages Activity Actions
discourse/plugins/poll/assets
History
Exact
discoursebot 1e9380558c
 SECURITY: Uncontrolled Resource Consumption in Number Poll Generation [backport 2026.5] (#41149) 
Backport of #41141 to release/2026.5.

---

## Summary

The markdown engine generates poll options in an unbounded loop based on
user input, enabling an attacker to trigger massive memory allocation
and CPU usage in the V8 process. This blocks a global mutex and can
cause worker crashes, effectively DoS-ing markdown processing for all
users.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1120
- HackerOne report: https://hackerone.com/reports/3598542

---

🤖 Auto-generated from the patch diff via Patch Triage. Review carefully
before merging.

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Sam <sam.saffron@gmail.com>
Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-06-24 15:52:37 +10:00
..
javascripts SECURITY: Uncontrolled Resource Consumption in Number Poll Generation [backport 2026.5] (#41149) 2026-06-24 15:52:37 +10:00
stylesheets FIX: Poll option mention overlap (#37972) 2026-02-23 08:28:23 -07:00