Zulip render endpoint lacks length limit, enabling denial of service
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-770.
Summary
Zulip Server versions before 12.2 do not enforce the normal message length limit on the POST /messages/render endpoint. The endpoint renders the content parameter without the limit that message send and edit operations use, which is a resource allocation flaw (CWE-770). An authenticated user can submit Markdown up to the server body-size limit, consuming disproportionate CPU, and repeated or concurrent requests can degrade rendering and availability for other users.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit Markdown up to the server body-size limit, causing disproportionate backend CPU consumption, and repeated or concurrent requests can degrade Markdown rendering performance or backend availability for other users. This issue is fixed in version 12.2.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Upgrade Zulip Server to version 12.2, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA zulip (zulip) Fixed in 12.2
Timeline
- 2026-11-04 Threatist record created from CVE-2026-97701
- 2026-11-06 Priority changed: MEDIUM → LOW
References
Other 6
- https://github.com/zulip/zulip/security/advisories/GHSA-m257-w4r5-5rmf
- https://github.com/zulip/zulip/pull/39913
- https://github.com/zulip/zulip/commit/31773c77c501391ede0fa8ec727f39508664e0ae
- https://github.com/zulip/zulip/commit/4d94dd2ee6337a4b3351694dd314a45d3fe11031
- https://github.com/zulip/zulip/releases/tag/12.2
- https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-12-2
More zulip vulnerabilities
- TI-2024-37129 /api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server CVSS 4.0MEDIUM 6.9
- TI-2026-20810 Zulip: Anonymous File Access After Disabling Spectator Access CVSS 3.1MEDIUM 5.3
- TI-2026-21062 Zulip: Path Traversal in Import CVSS 3.1MEDIUM 6.1
- TI-2021-19605 RabbitMQ exposes ports with weak default secrets in Zulip Server CVSS 3.1CRITICAL 9.8
- TI-2022-06082 Multi-use invitations can grant access to other organizations in Zulip CVSS 3.1CRITICAL 9.8
- TI-2023-15953 Users who can send invitations can erroneously add users to streams during invitation in Zulip CVSS 3.1LOW 3.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences