CVE-2023-6386

What it actually does

Triggers catastrophic backtracking in a regular expression used during CI/CD pipeline syntax validation, resulting in excessive CPU consumption and potential service denial.

Why it matters to the business

Service disruption for users editing pipelines in Discourse installations, with higher urgency due to the vulnerability remaining unpatched in many deployments nearly three years after publication.

How an attack unfolds

An attacker submits a maliciously crafted pipeline definition containing a regex-triggering pattern to the syntax verification endpoint; the server’s regex engine enters exponential backtracking, consuming resources until timeout or crash.

How to fix it

Upgrade discourse/discourse to commit f31f0b70f82c43d93220ce6fc0d4f57440452f37 or later; verify the fix is present by confirming the updated regex handling in the pipeline editor code.

How to confirm the fix worked

Test the syntax verification endpoint with known ReDoS payloads before and after upgrade; confirm the commit hash f31f0b70f82c43d93220ce6fc0d4f57440452f37 is deployed and monitor for absence of long-running regex evaluations.

Typical attack path

1. Identify a Discourse instance exposing the CI/CD pipeline editor
2. Craft a pipeline YAML or syntax snippet containing a ReDoS payload
3. Submit the payload via the syntax verification API or UI
4. Observe sustained high CPU usage or request timeout on the target server

How to detect it

Review web server and application logs for unusually long response times or high CPU on syntax verification endpoints; correlate with requests containing pipeline syntax payloads.

What your security team should do

• Apply the fix to commit f31f0b70f82c43d93220ce6fc0d4f57440452f37 immediately on all Discourse instances
• Add rate limiting and request timeouts around the pipeline syntax verification endpoint
• Monitor EPSS and exploit maturity indicators for any future increase in risk