What’s Vulnerable › Vulnerabilities

CVE-2023-45148: Rate limiter not working reliable when Memcached is installed in Nextcloud

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-16 · updated 2026-06-17
• Weakness: CWE-307

Description

Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgrade should change their config setting `memcache.distributed` to `\OC\Memcache\Redis` and install Redis instead of Memcached.

Affected products

• Nextcloud Server: from 22.0.0 before 22.2.10.16; from 23.0.0 before 23.0.12.11; from 24.0.0 before 24.0.12.7; from 25.0.0 before 25.0.11; from 26.0.0 before 26.0.6; 27.0.0 — fixed in 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6

How to fix

Upgrade to a fixed version: Nextcloud Server 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xmhp-7vr4-hp63
• https://github.com/nextcloud/server/pull/40293
• https://hackerone.com/reports/2110945
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xmhp-7vr4-hp63
• https://github.com/nextcloud/server/pull/40293
• https://hackerone.com/reports/2110945

Get alerted when CVE-2023-45148 or the next vulnerability affects your stack