CVE-2021-41271: Cache poisoning via maliciously-formed request in discourse

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-15 · updated 2026-06-17
Weakness: CWE-200

Description

Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cached by intermediate proxies. This could cause a loss of confidentiality for some content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.

Affected products

discourse: through 2.7.9; 2.8.0-beta1, 2.8.0-beta2, 2.8.0-beta3, 2.8.0-beta4, 2.8.0-beta5, 2.8.0-beta6 (+1)

References

https://github.com/discourse/discourse/commit/2da0001965c6d8632d723c46ea5df9f22a1a23f1
https://github.com/discourse/discourse/security/advisories/GHSA-hf6r-mc9j-hf4p
https://github.com/discourse/discourse/commit/2da0001965c6d8632d723c46ea5df9f22a1a23f1
https://github.com/discourse/discourse/security/advisories/GHSA-hf6r-mc9j-hf4p

Get alerted when CVE-2021-41271 or the next vulnerability affects your stack