PatchTheCVECVE-2024-31992: Mealie is a self hosted recipe manager and meal planner
CVE-2024-31992 is a medium-severity flaw (CVSS 6.5) affecting mealie. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a remote server, however these requests are not rate-limited. While there are efforts to prevent DDoS by implementing a timeout on requests, it is possible for an attacker to issue a large number of requests to the server which will be handled in batches based on the configuration of the Meali
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-31992?
mealie: upgrade to 1.4.0. Exact commands for each OS are on this page.
Is CVE-2024-31992 being exploited?
CVE-2024-31992 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-31992 affect?
CVE-2024-31992 affects mealie. Severity is medium (CVSS 6.5). Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a remote server, however these requests are not rate-limited. While there are effort
How urgent is CVE-2024-31992?
Priority 36/100. No elevated risk signals yet.
Related CVEs
- CVE-2025-70297 MEDIUM 6.1 UPGRADE A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Me
- CVE-2025-70296 MEDIUM 5.4 UPGRADE A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote au
- CVE-2025-56795 CRITICAL 9.0 UPGRADE Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionali
- CVE-2024-55073 HIGH 7.6 DOWNGRADE A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2
- CVE-2024-55072 MEDIUM 5.4 DOWNGRADE A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2