Vulnerability record · CVE-2023-45150 · published 16 October 2023

CVE-2023-45150: Nextcloud calendar uncontrolled resource consumption vulnerability

Nextcloud · Calendar

Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended that the Nextcloud Calendar app is upgraded to 4.4.4. The only workaround for users unable to upgrade is to disable the calendar app.

4.3 CVSS 3.1 Medium EPSS 0.39% · top 69.9% CWE-400 · Uncontrolled resource consumptionCWE-354 · CWE-354

4.3CVSS 3.1 base score

0.39%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Calendar Nextcloud

References

Link	Tags
https://github.com/nextcloud/calendar/pull/5358	Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r936-8gwm-w452	Vendor Advisory
https://hackerone.com/reports/2058337	ExploitIssue Tracking
https://github.com/nextcloud/calendar/pull/5358	Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r936-8gwm-w452	Vendor Advisory
https://hackerone.com/reports/2058337	ExploitIssue Tracking

Track CVE-2023-45150 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-24838Nextcloud calendar injection vulnerabilityNextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlines and …EPSS 33%11 Apr 2022 6.5CVE-2025-66511Nextcloud calendar vulnerabilityNextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash …EPSS 0.30%5 Dec 2025 6.5CVE-2023-48308Nextcloud calendar vulnerabilityNextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an except…EPSS 0.55%22 Dec 2023 5.7CVE-2025-66550Nextcloud calendar vulnerabilityNextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachme…EPSS 0.34%5 Dec 2025 4.8CVE-2018-3763Nextcloud calendar cross-site scripting vulnerabilityIn Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring…EPSS 0.61%5 Jul 2018 4.6CVE-2024-37316Nextcloud calendar vulnerabilityNextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redir…EPSS 0.36%14 Jun 2024 4.3CVE-2026-45286Nextcloud calendar information exposure vulnerabilityNextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user c…EPSS 0.46%1 Jun 2026 4.3CVE-2023-33183Nextcloud calendar improper authorization vulnerabilityCalendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMT…EPSS 0.44%30 May 2023

Source: NIST National Vulnerability Database (record CVE-2023-45150), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.