nextcloud/server · error · Forbidden

VEvent or VTodo object exceeds $eventSizeLimit bytes

Error message

VEvent or VTodo object exceeds $eventSizeLimit bytes

What it means

CalDavValidatePlugin subscribes to beforeMethod:PUT and rejects any CalDAV PUT whose raw CONTENT_LENGTH header exceeds the dav app setting event_size_limit (default 10485760 bytes = 10 MiB) with a Forbidden exception (HTTP 403). It is a cheap header-based guard that stops oversized VEVENT/VTODO payloads - usually inline ATTACH images or huge property blobs - before they are parsed or stored.

Source

Thrown at apps/dav/lib/CalDAV/Validation/CalDavValidatePlugin.php:36

use Sabre\HTTP\ResponseInterface;

class CalDavValidatePlugin extends ServerPlugin {

	public function __construct(
		private IAppConfig $config,
	) {
	}

	#[\Override]
	public function initialize(Server $server): void {
		$server->on('beforeMethod:PUT', [$this, 'beforePut']);
	}

	public function beforePut(RequestInterface $request, ResponseInterface $response): bool {
		// evaluate if card size exceeds defined limit
		$eventSizeLimit = $this->config->getValueInt(Application::APP_ID, 'event_size_limit', 10485760);
		if ((int)$request->getRawServerValue('CONTENT_LENGTH') > $eventSizeLimit) {
			throw new Forbidden("VEvent or VTodo object exceeds $eventSizeLimit bytes");
		}
		// all tests passed return true
		return true;
	}

}

View on GitHub (pinned to ecdeb153ff)

Solutions

1. Raise the limit: occ config:app:set dav event_size_limit --value='20971520' (bytes), then verify with occ config:app:get dav event_size_limit
2. Strip inline ATTACH data or replace it with a file link before PUT
3. Check the serialized event size client-side before uploading and warn the user
4. Confirm the request hits the instance whose config you changed - the setting is per dav app on that server

Example fix

# before
PUT /remote.php/dav/calendars/alice/personal/abc.ics   (Content-Length: 12000000)
-> 403 VEvent or VTodo object exceeds 10485760 bytes

# after
occ config:app:set dav event_size_limit --value='20971520'
PUT /remote.php/dav/calendars/alice/personal/abc.ics   -> 204 No Content

// client-side pre-check before PUT (server default 10 MiB)
$limit = 10485760; // keep in sync with dav event_size_limit
if (strlen($icsData) > $limit) {
    throw new PayloadTooLargeError('event is ' . strlen($icsData) . " bytes, limit {$limit}");
}

try {
    $client->request('PUT', $objectUrl, $icsData);
} catch (\Sabre\HTTP\ClientHttpException $e) {
    if ($e->getResponse()->getStatus() === 403 && str_contains($e->getMessage(), 'exceeds')) {
        // strip ATTACH data or ask the admin to raise dav event_size_limit
    }
}

When it happens

Trigger: PUT to /remote.php/dav/calendars/<user>/<calendar>/<object>.ics with a Content-Length header greater than dav event_size_limit (default 10 MiB); importing events that contain base64-encoded attachments.

Common situations: Events with pasted screenshots encoded inline; migrations from systems that embed attachments inside iCalendar; admins who lowered event_size_limit; clients adding very large custom X- properties.

Related errors

• VCard object exceeds $cardSizeLimit bytes
• Calendar limit reached
• Read-only sharees cannot permanently delete trashbin entries
• Permission denied to create a directory in the trashbin
• Permission denied to delete the trashbin

AI-assisted analysis of nextcloud/server@ecdeb153ff (2026-08-17). Data as JSON: /api/errors/964c8c56b73778a4. Report an issue: GitHub.