The official CVE record is not published yet
Listed from the vendor advisory. It will be replaced with the CVE.org / NVD record once published.
Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests
Summary
Impact
The authenticated POST /messages/render endpoint renders arbitrary user-supplied Markdown but, unlike the message send and edit endpoints, did not enforce Zulip's normal message length limit on its content parameter.
As a result, a single request could supply content up to the serve...
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Zulip Server |
<= 12.1 |
12.2 |
Original description The description as published by the source.
Impact
The authenticated POST /messages/render endpoint renders arbitrary user-supplied Markdown but, unlike the message send and edit endpoints, did not enforce Zulip's normal message length limit on its content parameter.
As a result, a single request could supply content up to the server's body-size limit to be rendered. Processing requests of this size would consume a disproportionate amount of backend CPU, and repeated or concurrent requests from a single authenticated account could degrade Markdown rendering performance or backend availability for other users.
Patches
Fixed in Zulip server 12.2.
Source: GitHub Repository Security Advisories (Game のスタック) NVD GitHub Advisory
References
- GITHUB_REPO_ADVISORY zulip/zulip