CVE-2023-25167
Discourse ≤ 3.0.1
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2023-25167 is a medium-severity Inefficient Regular Expression Complexity (CWE-1333) vulnerability in Discourse Discourse. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-29135
Vulnerability Data
Discourse is an open source discussion platform. In affected versions a malicious user can cause a regular expression denial of service using a carefully crafted git URL. This issue is patched in the latest stable, beta and tests-passed versions of…
more
Discourse. Users are advised to upgrade. There are no known workarounds for this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect and reject regex patterns with exponential worst-case complexity.
Secure development lifecycle mandates review of algorithmic efficiency, directly addressing ReDoS-prone regex.
Application security requirements can specify input-validation rules that limit regex complexity.
Secure architecture principles encourage avoidance of computationally expensive constructs such as catastrophic backtracking.
Secure coding standards explicitly prohibit or limit the use of inefficient regular expressions.