CVE-2026-97701

    Dashboard / Vulnerabilities / CVE-2026-97701

    CVE-2026-97701

    Published: 4 Nov 2026Last Modified: 8 Nov 2026

    Summary: Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests

    Details: Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit Markdown up to the server body-size limit, causing disproportionate backend CPU consumption, and repeated or concurrent requests can degrade Markdown rendering performance or backend availability for other users. This issue is fixed in version 12.2.

    References: https://github.com/zulip/zulip/releases/tag/12.2, https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-12-2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97701.json, https://github.com/zulip/zulip/security/advisories/GHSA-m257-w4r5-5rmf, https://nvd.nist.gov/vuln/detail/CVE-2026-97701, https://github.com/zulip/zulip/commit/31773c77c501391ede0fa8ec727f39508664e0ae, https://github.com/zulip/zulip/commit/4d94dd2ee6337a4b3351694dd314a45d3fe11031, https://github.com/zulip/zulip/pull/39913

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -1e73e1d754761b73c18135a3f25d0673f31cd8b3

    Affected versions

    12.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-97701 | CVE-DB