Vulnerability Database

309,083

Total vulnerabilities in the database

CVE-2022-39226

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the stable branch and prior to 2.9.0.beta10 on the beta and tests-passed branches, a malicious actor can add large payloads of text into the Location and Website fields of a user profile, which causes issues for other users when loading that profile. A fix to limit the length of user input for these fields is included in version 2.8.9 on the stable branch and version 2.9.0.beta10 on the beta and tests-passed branches. There are no known workarounds.

  • Published: Sep 29, 2022
  • Updated: Nov 16, 2025
  • CVE: CVE-2022-39226
  • Severity: Low
  • Exploit:

CVSS v3:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWEs:

Software From Fixed in
discourse / discourse 2.9.0-beta1 2.9.0-beta1.x
discourse / discourse 2.9.0-beta2 2.9.0-beta2.x
discourse / discourse 2.9.0-beta3 2.9.0-beta3.x
discourse / discourse 2.9.0-beta4 2.9.0-beta4.x
discourse / discourse 2.9.0-beta5 2.9.0-beta5.x
discourse / discourse 2.9.0-beta7 2.9.0-beta7.x
discourse / discourse 2.9.0-beta8 2.9.0-beta8.x
discourse / discourse 2.9.0-beta6 2.9.0-beta6.x
discourse / discourse 2.9.0-beta9 2.9.0-beta9.x
discourse / discourse - 2.8.9