CVE-2026-97701
Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit Markdown up to the server body-size limit, causing disproportionate backend CPU consumption, and repeated or concurrent requests can degrade Markdown rendering performance or backend availability for other users. This issue is fixed in version 12.2.
| CWE | CWE-770 |
| Vendor | zulip |
| Product | zulip |
| Published | Nov 4, 2026 |
| Last Updated | Nov 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for zulip zulip
Be the first to know when new medium vulnerabilities affecting zulip zulip are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
zulip / zulip
< 12.2
References
github.com: https://github.com/zulip/zulip/security/advisories/GHSA-m257-w4r5-5rmf github.com: https://github.com/zulip/zulip/pull/39913 github.com: https://github.com/zulip/zulip/commit/31773c77c501391ede0fa8ec727f39508664e0ae github.com: https://github.com/zulip/zulip/commit/4d94dd2ee6337a4b3351694dd314a45d3fe11031 github.com: https://github.com/zulip/zulip/releases/tag/12.2 zulip.readthedocs.io: https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-12-2