Vulnerability · Published Jan 28, 2026 · Assigned by GitHub_M

CVE-2025-68659Discourse has DoS vulnerability in username change endpoint

Medium 4.3

In plain English

A medium-severity resource allocation without limits in discourse from discourse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 82.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have an application level denial of service vulnerabilityin the username change functionality at try.discourse.org. The vulnerability allows attackers to cause noticeable server delays and resource exhaustion by sending large JSON payloads to the username preference endpoint PUT /u//preferences/username, resulting in degraded performance for other users and endpoints. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.

Affected products (as reported)

Vendor	Product	Versions
discourse	discourse	< 3.5.4>= 2025.11.0-latest, < 2025.11.2>= 2025.12.0-latest, < 2025.12.1>= 2026.1.0-latest, < 2026.1.0

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/discourse/discourse/security/advisories/GHSA-rmp6-c9rq-6q7p x_refsource_CONFIRM