# CVE-2024-46935: Rocket.Chat message parser denial of service

Source: https://junglewise.ai/threats/cve-2024-46935-rocket-chat-message-parser-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-09-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-46935 · Severity: low · CVSS 3.1 · Published 2024-09-25

Rocket.Chat, a widely-used team communication and collaboration platform, contains a vulnerability in its message parsing logic that can be exploited to crash the workspace. An attacker can craft specially-formatted messages containing specific characters that cause the message parser to consume excessive resources, resulting in a denial of service that disrupts all users on the affected instance.

Technologies: [Rocket.Chat](https://junglewise.ai/threats/technologies/rocket-chat). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Rocket.Chat](https://junglewise.ai/threats/vendors/rocket-chat).

## Quick answers

**Is CVE-2024-46935 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-46935 being exploited in the wild.

**How severe is CVE-2024-46935?** Low severity, with a CVSS score of 3.1, published 25 September 2024.

**Which products and versions are affected?** @rocket.chat/message-parser (npm) SEMVER:introduced=0,fixed=0.31.30; Rocket.Chat Message-Parser before 0.31.30; Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier.

**Is there a fix for CVE-2024-46935?** Yes. @rocket.chat/message-parser (npm): upgrade to 0.31.30 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-46935 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2024-46935?** Check whether you run @rocket.chat/message-parser (npm), Rocket.Chat Message-Parser or Rocket.Chat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @rocket.chat/message-parser (npm): upgrade to 0.31.30 or later

  ```sh
  npm install @rocket.chat/message-parser@0.31.30
  ```


## Technical details

The vulnerability exists in Rocket.Chat's message parser component (@rocket.chat/message-parser), which fails to efficiently handle messages containing excessive symbols or specific character sequences. An unauthenticated remote attacker can send a crafted message that triggers catastrophic performance degradation in the parser, consuming significant CPU or memory resources and causing the workspace to become unresponsive or crash. The root cause is related to CWE-400 (uncontrolled resource consumption) in the message parsing logic. The fix was merged in PR #33227 and is available in Rocket.Chat 6.12.1 and later, as well as in message-parser version 0.31.30 and above.

## Affected products

- Rocket.Chat Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier
- Rocket.Chat message-parser before 0.31.30

## Identifiers

- CVE-2024-46935
- GHSA-6375-pg5j-8wph

## Timeline

- 2024-09-25: disclosed: Vulnerability publicly disclosed
- 2024-09-25: patched: Fix released in Rocket.Chat 6.12.1 and message-parser 0.31.30

## References

- [https://github.com/RocketChat/Rocket.Chat/pull/33227](https://github.com/RocketChat/Rocket.Chat/pull/33227)

## Related threats

- [Rocket.Chat sendForgotPasswordEmail method missing DDP rate limit](https://junglewise.ai/threats/cve-2026-75575-rocket-chat-sendforgotpasswordemail-method-missing-ddp-rate-limit)
- [Rocket.Chat Meteor DDP method authorization bypass](https://junglewise.ai/threats/cve-2026-65645-rocket-chat-meteor-ddp-method-authorization-bypass)
- [Rocket.Chat Omnichannel queue stored XSS via visitor name](https://junglewise.ai/threats/cve-2026-65644-rocket-chat-omnichannel-queue-stored-xss-via-visitor-name)
- [Rocket.Chat authentication bypass in SAML SSO](https://junglewise.ai/threats/cve-2026-58066-rocket-chat-authentication-bypass-in-saml-sso)
- [Rocket.Chat missing authorization in fingerprint REST endpoint](https://junglewise.ai/threats/cve-2026-55762-rocket-chat-missing-authorization-in-fingerprint-rest-endpoint)