CVE-2023-48297 is a high severity (CVSS 8.6) denial of service flaw in Discourse. The message serializer expanded @all and @here chat mentions into a very long list of users. The advisory lists stable 3.1.4 and beta 3.2.0.beta4 as patched, while the NVD text says beta5.
What's affected
Discourse advisory GHSA-hf2v-r5xm-8p37, published on 9 January 2024, lists affected versions as stable 3.1.3 and earlier, and beta and tests-passed 3.2.0.beta3 and earlier. It lists patched versions as stable 3.1.4 or later and beta and tests-passed 3.2.0.beta4 or later.
The NVD record's text says the issue was patched in 3.1.4 and beta 3.2.0.beta5. The advisory says beta4. Because the sources disagree on the beta number, treat 3.2.0.beta5 or later as safe on the beta channel, and 3.1.4 or later on stable.
The advisory rates it High at 8.6, which matches the record's CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H vector: network, no privileges, a changed scope and a high availability impact only. The weakness is CWE-400 (Uncontrolled Resource Consumption). The record does not flag the CVE as exploited in the wild.
How to check if you're exposed
Sign in as an administrator and open the Admin dashboard, which shows the installed Discourse version and whether an update is waiting. For a standard Docker install you can also read the version from the host.
cd /var/discourse
git log -1 --format=%cd
./launcher enter app
The updater page in the admin area is the easier source for the version string. Compare it with the patched versions above.
If you use the chat feature, you are in scope. The advisory's workaround is to use watched words to block the @all and @here mentions, but it still recommends upgrading.
What to do now
- Upgrade to stable 3.1.4 or later, or to a beta newer than 3.2.0.beta4. Use the admin updater, or
./launcher rebuild appon a standard install. - If you cannot upgrade today, add watched words that block the @all and @here mentions in chat, as the advisory suggests.
- Watch server load and response times in chat channels with many members.
- Take a backup before rebuilding, as you would for any upgrade.
- Subscribe to Discourse security announcements so the next advisory reaches you.
Why it matters
The code built a list of every user covered by a group mention, and the message serializer carried the whole list. A channel with many members turned one message into a very large payload. Nothing capped the work, which is why the class is CWE-400 (Uncontrolled Resource Consumption).
Denial of service flaws score high when no login is needed, and a changed scope shows that the effect reaches beyond the chat component to the application as a whole. Any feature that expands a group into individual records should have a limit. Continuous monitoring of the software you host helps you spot a vulnerable version quickly. See the Safeguard Gold page for this CVE for the record.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Discourse versions fix CVE-2023-48297?
The advisory lists stable 3.1.4 and beta or tests-passed 3.2.0.beta4. The NVD text says 3.2.0.beta5, so use beta5 or later on beta.
Is there a workaround?
Yes. The advisory says watched words can block @all and @here in chat, but it still recommends upgrading.
Sources
Last reviewed: 19 October 2026.
