Read the docs
TI-2024-14381 Aliases CVE-2024-21658

Insufficient control of region value length in discourse-calendar

Priority LOW 20CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on region value length is too generous. This allows a malicious actor to cause a Discourse instance to use excessive bandwidth and disk space. This issue has been patched in main the main branch. There are no workarounds for this vulnerability. Please upgrade as soon as possible.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00362 30th percentileScored 2026-11-07
Fix Fixed discourse-calendar (discourse): 66259cd21dc6a1b2139d9833f3f847d8013e6759

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
discoursediscourse-calendarbefore 66259cd21dc6a1b2139d9833f3f847d8013e675966259cd21dc6a1b2139d9833f3f847d8013e6759Patch availableCNA
  • discourse-calendar Vendordiscourse Affected before 66259cd21dc6a1b2139d9833f3f847d8013e6759 Fixed in 66259cd21dc6a1b2139d9833f3f847d8013e6759 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:discourse:discourse_calendar:*:*:*:*:*:discourse:*:*before 2024-08-28Vulnerablediscourse
  • cpe:2.3:a:discourse:discourse_calendar:*:*:*:*:*:discourse:*:* Versions before 2024-08-28 Vulnerable ·discourse

Remediation

  • Fix · CNA discourse-calendar (discourse) Fixed in 66259cd21dc6a1b2139d9833f3f847d8013e6759

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-21658

References

Advisory 1

  • TI-2023-23383 Improper escaping of user input in discourse-calendar CVSS 3.1HIGH 8.0
  • TI-2022-13104 Discourse Calendar Event names susceptible to Cross-site Scripting CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences