Nextcloud · disclosed reports
Denial of Service
23 disclosed reports · $450 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Nextcloud on HackerOne- reports
- 23
- paid a bounty
- 3
Every one of the 23 is a mark on the map. Named now: 1 to 23, most upvoted first.
- Inviting excessive long email addresses to a calendar event makes the server unresponsive
- Memory Leak in OCUtil.dll library in Desktop client can lead to DoS
- No password length limit when creating a user as an administrator
- Denial of Service by requesting to reset a password
- Database resource exhaustion for logged-in users via sharee recommendations with circles
- No password length restriction in reset password endpoint
- Missing character limitation allows to put generate a database error
- Missing length validation of user displayname allows to generate an SQL error
- index.php/apps/files_sharing/shareinfo endpoint is not properly protected
- Improper input-size validation on the user new session name can result in server-side DDoS.
- Uploading large avatar images cause excessive CPU usage
- Potential DDoS when posting long data into workflow validation rules
- Calendar name length not validated before writing to database
- Reference fetch can saturate the server bandwidth for 10 seconds
- @nextcloud/logger NPM package brings vulnerable ansi-regex version
- DoS due to improper input validation can break the admin access into the user data will disallow him from editing that user's data.
- Filename enumeration && DoS
- help.nextcloud.com: Known DoS condition (null pointer deref) in Nginx running
- Unauthenticated Persistent Denial-of-Service via Federated Share Injection
- ci.nextcloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)
- DoS attack against the client when entering a long password
- WebDAV Empty Property search leads to full CPU usage
- Slow Http attack on nextcloud(DOS)
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.