CVE-2025-68659
Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have an application level denial of service vulnerabilityin the username change functionality at try.discourse.org. The vulnerability allows attackers to cause noticeable server delays and resource exhaustion by sending large JSON payloads to the username preference endpoint PUT /u//preferences/username, resulting in degraded performance for other users and endpoints. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.
- Affected products
- Discourse
- Discourse
- < 3.5.4, 2025.11.2, 2025.12.0, 2026.1.0
- Fix
- Available
- CVSS 3.1
- 5.3 MEDIUM
- EPSS
- 0.2% (12th percentile)
- Weakness
- CWE-770
- NVD status
- Analyzed
- Published
- 2026-01-28
No indexed exploits for CVE-2025-68659 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2025-68659 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.