CVE-2025-68934: 
NixOS vulnerability analysis and mitigation

CVE-2025-68934 is a Denial of Service (DoS) vulnerability in Discourse, an open-source discussion platform, caused by an algorithmic complexity flaw in the Base62.decode function. Authenticated users can submit crafted payloads to the /drafts.json endpoint that trigger O(n²) processing, tying up server workers for 35–60 seconds per request and exhausting the shared worker pool for all users. Affected versions include all releases prior to 3.5.4 (stable), 2025.11.2, 2025.12.1, and 2026.1.0. It was published on January 28, 2026, with a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is an algorithmic complexity issue (CWE-770: Allocation of Resources Without Limits or Throttling) in Discourse's Base62.decode function, which processes input in O(n²) time relative to payload size. An authenticated attacker sends a crafted HTTP request to the /drafts.json endpoint with a specially constructed payload that forces the server into this quadratic processing path. Because Discourse uses a shared worker pool, a single such request can monopolize a worker for 35–60 seconds, and repeated requests from one or more accounts can exhaust the pool entirely, denying service to all users. No memory corruption or code execution is involved; the attack is purely resource exhaustion (GitHub Advisory).

Successful exploitation results in a high-availability impact: the shared Discourse worker pool becomes exhausted, rendering the platform unresponsive for all users during the attack. There is no confidentiality or integrity impact — attackers cannot read data or modify content through this vulnerability. The scope is limited to the affected Discourse instance, with no lateral movement potential, but even a single authenticated attacker can sustain a denial-of-service condition with minimal effort (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The vulnerability requires only a low-privilege authenticated account, making it accessible to any registered Discourse user. The EPSS score is approximately 0.04%, indicating a low probability of near-term exploitation. CVE-2025-68934 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Obtain authentication: Register or obtain credentials for any user account on a vulnerable Discourse instance (versions prior to 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0).
2. Craft the payload: Construct a draft payload specifically designed to trigger the O(n²) processing path in Base62.decode. The payload should be structured to maximize the quadratic processing time while remaining within or near the max_draft_length limit.
3. Submit to the endpoint: Send an authenticated HTTP POST request to /drafts.json with the crafted payload, using standard HTTP tools (e.g., curl, Burp Suite, or a custom script).
4. Repeat for sustained DoS: Send repeated requests (potentially from multiple accounts or in rapid succession) to keep the worker pool exhausted, preventing legitimate users from accessing the platform for the duration of the attack (GitHub Advisory).

• Network: Repeated POST requests to /drafts.json from one or more authenticated user accounts in a short time window; unusually high request latency or timeouts on the Discourse application.
• Logs: Discourse application logs showing /drafts.json requests taking 35–60 seconds to process; worker timeout or queue exhaustion errors in server logs.
• Process: Discourse worker processes consistently at high CPU utilization with long-running Base62.decode operations; worker pool saturation alerts if monitoring is configured.

Discourse has released patched versions: 3.5.4 (stable), 2025.11.2, 2025.12.1, and 2026.1.0. Upgrading to one of these versions is the recommended and only complete remediation. As a partial workaround, administrators can lower the max_draft_length site setting to reduce the attack surface, but this does not fully mitigate the issue since payloads under the limit can still trigger the vulnerable code path. Rate-limiting authenticated requests to the /drafts.json endpoint at the web server or reverse proxy level may also help reduce impact (GitHub Advisory).

The vulnerability was reported by researcher dpaysm and patched by Discourse maintainer davidtaylorhq, who published the GitHub Security Advisory on January 28, 2026. No significant broader media coverage or notable community commentary beyond standard vulnerability tracking has been identified for this CVE.