CVE-2022-39226: 
NixOS vulnerability analysis and mitigation

CVE-2022-39226 is a vulnerability affecting Discourse versions stable <= 2.8.8, beta <= 2.9.0.beta9, and tests-passed <= 2.9.0.beta9. The vulnerability was discovered and disclosed in September 2022, affecting the user profile functionality in Discourse installations (GitHub Advisory).

The vulnerability stems from insufficient length limitations in the Location and Website fields of user profiles. Prior to the fix, these fields did not have proper length restrictions at both the model and database levels, unlike the bio_raw field which had a 3000-character limit (GitHub Commit).

When exploited, this vulnerability allows malicious actors to add large payloads of text into the Location and Website fields of a user profile, which causes performance issues for other users when loading that profile (GitHub Advisory).

The vulnerability was patched in Discourse versions stable >= 2.8.9, beta >= 2.9.0.beta10, and tests-passed >= 2.9.0.beta10. The fix implements a 3000-character limit for both Location and Website fields at both the model and database levels (GitHub Commit).