Description
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit Markdown up to the server body-size limit, causing disproportionate backend CPU consumption, and repeated or concurrent requests can degrade Markdown rendering performance or backend availability for other users. This issue is fixed in version 12.2.
Published: 2026-11-04
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

Zulip Server’s authenticated POST /messages/render endpoint does not enforce the usual content-length limit, allowing a logged‑in user to send excessive Markdown content up to the server body‑size limit. The oversized payload consumes disproportionate backend CPU during rendering, which can degrade performance or make the service unavailable for other users.

Affected Systems

All Zulip Server installations using versions up to 12.1. The vulnerability is fixed in version 12.2 and later.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. Exploitation requires authentication and sending large requests; repeated or concurrent attacks can overload the rendering engine. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The risk is therefore moderate but potentially high impact in environments with many concurrent users or insufficient server resources.

Generated by OpenCVE AI on November 4, 2026 at 20:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Zulip Server to version 12.2 or newer.
  • If an upgrade is not immediately possible, configure the server or reverse proxy to limit POST request body size below the rendering threshold.
  • Implement rate‑limiting or throttling for the /messages/render endpoint to prevent repeated large requests from a single user.

Generated by OpenCVE AI on November 4, 2026 at 20:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 04 Nov 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Zulip
Zulip zulip
Vendors & Products Zulip
Zulip zulip

Wed, 04 Nov 2026 19:15:00 +0000

Type Values Removed Values Added
Description Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit Markdown up to the server body-size limit, causing disproportionate backend CPU consumption, and repeated or concurrent requests can degrade Markdown rendering performance or backend availability for other users. This issue is fixed in version 12.2.
Title Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Zulip Zulip
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-11-04T20:31:41.109Z

Reserved: 2026-09-24T21:43:37.209Z

Link: CVE-2026-97701

cve-icon Vulnrichment

Updated: 2026-11-04T20:31:35.394Z

cve-icon NVD

Status : Received

Published: 2026-11-04T19:17:41.793

Modified: 2026-11-04T21:18:17.240

Link: CVE-2026-97701

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T21:00:18Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling