CVE-2024-21658: Insufficient control of region value length in discourse-calendar

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-30 · updated 2026-06-17
Weakness: CWE-400

Description

discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on region value length is too generous. This allows a malicious actor to cause a Discourse instance to use excessive bandwidth and disk space. This issue has been patched in main the main branch. There are no workarounds for this vulnerability. Please upgrade as soon as possible.

Affected products

Discourse Calendar: before 2024-08-28 — fixed in 2024-08-28

How to fix

Upgrade to a fixed version: Discourse Calendar 2024-08-28. Check the vendor advisory for mitigations.

References

https://github.com/discourse/discourse-calendar/security/advisories/GHSA-65f2-9ghp-x8h8

Get alerted when CVE-2024-21658 or the next vulnerability affects your stack