CVE-2023-28644

Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server performances and/or can lead to a denial of service. This issue has been addressed and it is recommended that the Nextcloud Server is upgraded to 25.0.3. There are no known workarounds for this vulnerability.

• CWE-400

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9wmj-gp8v-477jVendor Advisory
• https://github.com/nextcloud/server/pull/36016Issue Tracking, Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9wmj-gp8v-477jVendor Advisory
• https://github.com/nextcloud/server/pull/36016Issue Tracking, Patch

Published

Mar 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28638Snappier is a high performance C# implementation of the Snap…5.9
• CVE-2023-28639GLPI is a free asset and IT management software package. Sta…6.1
• CVE-2023-2864A vulnerability was found in SourceCodester Online Jewelry S…6.1
• CVE-2023-28640Apiman is a flexible and open source API Management platform…3.1
• CVE-2023-28642runc is a CLI tool for spawning and running containers accor…7.8
• CVE-2023-28643Nextcloud server is an open source home cloud implementation…8.8
• CVE-2023-28645Nextcloud richdocuments is a Nextcloud app integrating the o…6.5
• CVE-2023-28646Nextcloud android is an android app for interfacing with the…2.4
• CVE-2023-28647Nextcloud iOS is an ios application used to interface with t…6.8
• CVE-2023-28648Osprey Pump Controller version 1.01 inputs passed to a GET p…6.1
• CVE-2023-28649The Hub in the Snap One OvrC cloud platform is a device used…7.5
• CVE-2023-2865A vulnerability was found in SourceCodester Theme Park Ticke…9.8