{"id":"CVE-2026-97701","kind":"vulnerability","aliases":["CVE-2026-97701"],"related":[],"title":"Zulip: unbounded Markdown render request lets one user slow the server","description":"Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit Markdown up to the server body-size limit, causing disproportionate backend CPU consumption, and repeated or concurrent requests can degrade Markdown rendering performance or backend availability for other users. This issue is fixed in version 12.2.","summary":"Zulip Server through version 12.1 has an authenticated endpoint, POST /messages/render, that renders Markdown without the message length limit used elsewhere. A logged-in user can send very large Markdown and, by repeating or running requests concurrently, use up backend CPU and degrade service for other users.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chat","runtime","self-hosted","zulip"],"not_affected_if":["already-on-12.2","managed-hosting","no-public-signup"],"how_to_check":"- Check the Zulip Server version, for example with `/etc/zulip/zulip.conf` or the admin page, and see whether it is `12.1` or earlier.\n- Check whether your server is reachable by users who hold a regular account.","fix":"- Zulip Server: move to `12.2`.","status":"open","published_at":"2026-11-04T19:17:41+00:00","first_seen_at":"2026-11-04T19:28:49+00:00","triaged_at":"2026-11-04T19:30:15+00:00","updated_at":"2026-11-04T19:30:15+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-04T19:30:15Z","model":"claude-haiku-5-5","output":{"fix":"- Zulip Server: move to `12.2`.","reach":"network","title":"Zulip: unbounded Markdown render request lets one user slow the server","impact":"low","summary":"Zulip Server through version 12.1 has an authenticated endpoint, POST /messages/render, that renders Markdown without the message length limit used elsewhere. A logged-in user can send very large Markdown and, by repeating or running requests concurrently, use up backend CPU and degrade service for other users.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["zulip","self-hosted","chat"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"one account degrades server CPU and Markdown rendering for everyone","analyst_note":"","how_to_check":"- Check the Zulip Server version, for example with `/etc/zulip/zulip.conf` or the admin page, and see whether it is `12.1` or earlier.\n- Check whether your server is reachable by users who hold a regular account.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","already-on-12.2","no-public-signup"],"who_is_affected":"Self-hosted Zulip Server instances at version 12.1 or earlier are exposed, and only users who already have an account can trigger the problem. Zulip Cloud and servers already on 12.2 are not affected by this text. Teams that let many outside users sign up are at higher risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000692,"input_tokens":4222,"output_tokens":540,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-97701':14A,17A '/messages/render':34B,90C '12.1':28B,86C '12.2':151C 'authent':31B,88C,111C 'avail':141C 'backend':64B,126C,140C 'bodi':121C 'body-s':120C 'caus':124C 'chat':18B 'collabor':79C 'concurr':61B,132C 'consumpt':128C 'content':94C 'cpu':65B,127C 'cve':12A,15A 'degrad':67B,135C 'disproportion':125C 'edit':108C 'elsewher':44B 'endpoint':32B,91C 'enforc':97C 'fix':148C 'host':22B 'issu':146C 'larg':53B 'length':41B,101C 'let':6A 'limit':42B,102C,123C 'log':47B 'logged-in':46B 'markdown':3A,37B,54B,115C,136C 'messag':40B,100C,105C 'normal':99C 'one':7A 'open':76C 'open-sourc':75C 'oper':109C 'paramet':95C 'perform':138C 'post':33B,89C 'render':4A,36B,92C,137C 'repeat':57B,130C 'request':5A,60B,133C 'run':59B 'runtim':19B 'self':21B 'self-host':20B 'send':51B,106C 'server':11A,25B,83C,119C 'servic':68B 'size':122C 'slow':9A 'sourc':77C 'submit':114C 'team':78C 'tool':80C 'unbound':2A 'use':43B,62B,103C 'user':8A,49B,71B,112C,144C 'version':27B,84C,150C 'without':38B,96C 'zulip':1A,23B,24B,72C,82C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Zulip Server instances at version 12.1 or earlier are exposed, and only users who already have an account can trigger the problem. Zulip Cloud and servers already on 12.2 are not affected by this text. Teams that let many outside users sign up are at higher risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["chat","medium","runtime","selfhosted","zulip"],"campaign_type":null,"first_public_at":"2026-08-10T17:24:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97701","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97701","severity":null,"published_at":"2026-11-04T19:17:41+00:00","modified_at":"2026-11-04T19:17:41+00:00","first_seen_at":"2026-11-04T19:28:49+00:00","fetched_at":"2026-11-04T19:28:49+00:00","note":null}],"documents":[{"id":69755,"url":"https://github.com/zulip/zulip/commit/31773c77c501391ede0fa8ec727f39508664e0ae","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":69756,"url":"https://github.com/zulip/zulip/commit/4d94dd2ee6337a4b3351694dd314a45d3fe11031","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":69757,"url":"https://github.com/zulip/zulip/releases/tag/12.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":69758,"url":"https://github.com/zulip/zulip/security/advisories/GHSA-m257-w4r5-5rmf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-10T17:24:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}