CVE-2023-28644 MEDIUM

CVE-2023-28644: Reference fetch can saturate the server bandwidth for 10 seconds in nextcloud server

Vendor Nextcloud

Product security-advisories

Weakness CWE-400

Published March 30, 2023

Last update February 11, 2025

View on NVD All CVEs

CVSS base score

5.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server performances and/or can lead to a denial of service. This issue has been addressed and it is recommended that the Nextcloud Server is upgraded to 25.0.3. There are no known workarounds for this vulnerability.

Key dates

02Disclosure timeline

March 30, 2023 CVE published

February 11, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-28644 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/400.html

Related vulnerabilities

04Related CVE

CVE-2021-0202 Junos OS: MX Series, EX9200 Series: Trio-based MPC memory leak when Integrated Routing and Bridging (IRB) interface is mapped to a VPLS instance or a Bridge-Domain CVE-2020-15101 Nested directory structure can lead to Uncontrolled Resource Consumption in freewvs CVE-2023-43775 Security issue in SMP Gateway automation platform CVE-2022-43893 IBM Security Verify Privilege denial of service CVE-2026-25122 apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams