Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Slow Http attack on nextcloud(DOS)#163823	Valid	Denial of Service	–	2016-10-05	–	1
WebDAV Empty Property search leads to full CPU usage#255822	Valid	Denial of Service	–	2020-03-01	–	1
DoS attack against the client when entering a long password#949712	Valid	Denial of Service	–	2021-02-14	–	2
ci.nextcloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)#237860	Valid	Denial of Service	–	2017-06-08	–	3
Unauthenticated Persistent Denial-of-Service via Federated Share Injection#3679640	Valid	Denial of Service	High	2026-10-27	–	3
help.nextcloud.com: Known DoS condition (null pointer deref) in Nginx running#145409	Valid	Denial of Service	–	2016-07-27	–	4
Filename enumeration && DoS#174524	Valid	Denial of Service	–	2017-02-09	–	4
DoS due to improper input validation can break the admin access into the user data will disallow him from editing that user's data.#1147611	Valid	Denial of Service	–	2021-06-01	–	4
@nextcloud/logger NPM package brings vulnerable ansi-regex version#1607601	Valid	Denial of Service	–	2022-07-29	–	4
Reference fetch can saturate the server bandwidth for 10 seconds#1806223	Valid	Denial of Service	Medium	2023-04-29	–	4
Calendar name length not validated before writing to database#1596148	Valid	Denial of Service	–	2022-12-01	–	5
Potential DDoS when posting long data into workflow validation rules#1018146	Valid	Denial of Service	–	2021-01-21	–	6
Uploading large avatar images cause excessive CPU usage#504759	Valid	Denial of Service	–	2019-06-27	–	8
Improper input-size validation on the user new session name can result in server-side DDoS.#1153138	Valid	Denial of Service	–	2022-05-31	–	10
index.php/apps/files_sharing/shareinfo endpoint is not properly protected#1173684	Valid	Denial of Service	–	2021-08-11	$100	10
Missing length validation of user displayname allows to generate an SQL error#1588562	Valid	Denial of Service	–	2022-12-20	–	12
Missing character limitation allows to put generate a database error#1596059	Valid	Denial of Service	–	2023-01-09	–	12
No password length restriction in reset password endpoint#1820864	Valid	Denial of Service	Low	2023-02-09	–	12
Database resource exhaustion for logged-in users via sharee recommendations with circles#1688199	Valid	Denial of Service	–	2022-11-26	$250	13
Denial of Service by requesting to reset a password#812754	Valid	Denial of Service	–	2021-01-25	–	20
No password length limit when creating a user as an administrator#1727424	Valid	Denial of Service	Low	2022-12-31	–	39
Memory Leak in OCUtil.dll library in Desktop client can lead to DoS#588562	Valid	Denial of Service	–	2020-08-06	$100	40
Inviting excessive long email addresses to a calendar event makes the server unresponsive#2058337	Valid	Denial of Service	Medium	2023-10-16	–	46

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.