CVE-2026-97701

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...

CVE-2026-97701

Zulip Server versions through 12.1 are vulnerable to a resource exhaustion issue in the POST /messages/render endpoint. The vulnerability occurs because the content parameter is rendered without enforcing the standard message length limits applied to message send and edit operations. An authentic...

EUVD-2026-117032

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...

CVE-2026-97701 Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...