CVE-2023-28644

7.5 highEPSS 0.6%

High (7.5) in nextcloud nextcloud server. EPSS 0.6% chance of exploitation in the next 30 days.

Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server performances and/or can lead to a denial of service. This issue has been addressed and it is recommended that the Nextcloud Server is upgraded to 25.0.3. There are no known workarounds for this vulnerability.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-400
Published: 2023-03-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

nextcloud:nextcloud_server

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9wmj-gp8v-477j
https://github.com/nextcloud/server/pull/36016
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9wmj-gp8v-477j
https://github.com/nextcloud/server/pull/36016

Check your stack JSON