CVE-2024-21658

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-21658

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-21658.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-21658

Aliases

GHSA-65f2-9ghp-x8h8

Published

2024-08-30T17:18:40Z

Modified

2026-10-28T02:30:54Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Insufficient control of region value length in discourse-calendar

Details

discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on region value length is too generous. This allows a malicious actor to cause a Discourse instance to use excessive bandwidth and disk space. This issue has been patched in main the main branch. There are no workarounds for this vulnerability. Please upgrade as soon as possible.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-400"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21658.json"
}

References

Affected packages

Git / github.com/discourse/discourse-calendar

Affected ranges

Type

GIT

Repo

https://github.com/discourse/discourse-calendar

Events

Introduced

Fixed

66259cd21dc6a1b2139d9833f3f847d8013e6759

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "66259cd21dc6a1b2139d9833f3f847d8013e6759"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-21658.json"