CVE-2025-68934

CVE-2025-68934 is a medium-severity vulnerability in Discourse with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-770.

Key facts

Description

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, authenticated users can submit crafted payloads to /drafts.json that cause O(n^2) processing in Base62.decode, tying up workers for 35-60 seconds per request. This affects all users as the shared worker pool becomes exhausted. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. Lowering the max_draft_length site setting reduces attack surface but does not fully mitigate the issue, as payloads under the limit can still trigger the slow code path.

Frequently asked questions

What is CVE-2025-68934?
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, authenticated users can submit crafted payloads to /drafts.json that cause O(n^2) processing in Base62.decode, tying up workers for 35-60 seconds per request. This affects all users as the shared worker pool becomes exhausted. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. Lowering the max_draft_length site setting reduces attack surface but does not fully mitigate the issue, as payloads under the limit can still trigger the slow code path.
How severe is CVE-2025-68934?
CVE-2025-68934 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2025-68934 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-68934?
CVE-2025-68934 primarily affects Discourse. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2025-68934?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-68934 have an EU (EUVD) identifier?
Yes. CVE-2025-68934 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-206443.
When was CVE-2025-68934 published?
CVE-2025-68934 was published on 2026-01-28 and last updated on 2026-06-17.

References

Affected products (3)

More vulnerabilities in Discourse

All CVEs affecting Discourse →

Other CWE-770 (Allocation of Resources Without Limits or Throttling) vulnerabilities

Browse all CWE-770 (Allocation of Resources Without Limits or Throttling) vulnerabilities →