CVE-2021-43850: Denial of Service in discourse

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-01-04 · updated 2026-06-17
Weakness: CWE-20

Description

Discourse is an open source platform for community discussion. In affected versions admins users can trigger a Denial of Service attack via the `/message-bus/_diagnostics` path. The impact of this vulnerability is greater on multisite Discourse instances (where multiple forums are served from a single application server) where any admin user on any of the forums are able to visit the `/message-bus/_diagnostics` path. The problem has been patched. Please upgrade to 2.8.0.beta10 or 2.7.12. No workarounds for this issue exist.

Affected products

discourse: before 2.7.12; 2.8.0-beta1, 2.8.0-beta2, 2.8.0-beta3, 2.8.0-beta4, 2.8.0-beta5, 2.8.0-beta6 (+3) — fixed in 2.7.12

How to fix

Upgrade to a fixed version: discourse 2.7.12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-43850 or the next vulnerability affects your stack