CVE-2026-97701 · Runtime
NO FIX YET · SEE WHAT TO DO
Zulip Server through version 12.1 has an authenticated endpoint, POST /messages/render, that renders Markdown without the message length limit used elsewhere. A logged-in user can send very large Markdown and, by repeating or running requests concurrently, use up backend CPU and degrade service for other users.
first public Aug 10, 2026 · 1 source
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Self-hosted Zulip Server instances at version 12.1 or earlier are exposed, and only users who already have an account can trigger the problem. Zulip Cloud and servers already on 12.2 are not affected by this text. Teams that let many outside users sign up are at higher risk.
Not affected if already-on-12.2, managed-hosting, no-public-signup
Who cares chat, self-hosted, zulip
/etc/zulip/zulip.conf or the admin page, and see whether it is 12.1 or earlier.12.2.Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit Markdown up to the server body-size limit, causing disproportionate backend CPU consumption, and repeated or concurrent requests can degrade Markdown rendering performance or backend availability for other users. This issue is fixed in version 12.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-97701") · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.