CVE-2026-97701
Received Received - Intake

Denial of Service in Zulip Server via Markdown Rendering

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit Markdown up to the server body-size limit, causing disproportionate backend CPU consumption, and repeated or concurrent requests can degrade Markdown rendering performance or backend availability for other users. This issue is fixed in version 12.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-97701
EUVD
EUVD-2026-117032

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zulip zulip < 12.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Zulip Server versions through 12.1 allows authenticated users to submit Markdown content via the POST /messages/render endpoint without the usual message length restrictions. This can lead to excessive CPU usage on the server due to disproportionate backend processing.

Detection Guidance

Monitor for unusually high CPU usage during Markdown rendering operations. Check for repeated POST requests to /messages/render with large payloads. Inspect server logs for requests exceeding normal message length limits.

Impact Analysis

An attacker could exploit this to degrade server performance or cause downtime by repeatedly sending large Markdown requests. This may slow down or crash the Zulip server, affecting all users.

Mitigation Strategies

Upgrade Zulip Server to version 12.2 or later. Apply rate limiting to the /messages/render endpoint. Monitor and block excessive Markdown content submissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97701. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...