CVE-2023-45150 Inviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive
Attackers can cause server unresponsiveness by inviting excessively long email addresses to calendar events, requiring an upgrade of the Nextcloud Calendar app.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-45150?
CVE-2023-45150 is a medium-severity denial of service vulnerability in nextcloud security-advisories, published on 16 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended that the Nextcloud Calendar app is upgraded to 4.4.4. The only workaround for users unable to upgrade is to disable the calendar app.
Which versions are affected by CVE-2023-45150?
It affects 1 product.
Products include Nextcloud Calendar.
How do I fix CVE-2023-45150?
No fix has been published for CVE-2023-45150 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-45150 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-45150 exists.
Other vulnerabilities in nextcloud security-advisories
- CVE-2025-66550 Nextcloud Calendar attachments of local files are offered to downloaded
- CVE-2022-24838 Command Injection in Appointment Emails for Nextcloud Calendar
- CVE-2025-66511 Nextcloud Calendar app used predictable proposal participant tokens
- CVE-2018-3763 Cross-site scripting in Nextcloud Calendar application
- CVE-2024-37316 Nextcloud Calendar's event create can create attachments that link to other websites
Sources
Also known as GHSA-r936-8gwm-w452.