Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
profile-picture name parameter with large value lead to DoS for other users and programs on the platformAnalysed#764434	Valid	Denial of Service	Medium	2020-03-25	–	475
Uploading large payload on domain instructions causes server-side DoSAnalysed#887321	Valid	Denial of Service	Medium	2020-06-20	$2,500	210
ActiveStorage throws exception when using whitespace as filename, may lead to denial of service of multiple pagesAnalysed#713407	Valid	Denial of Service	Medium	2019-12-13	–	111
Attacker with an Old account might still be able to DoS ctf.hacker101.com by sending a Crafted requestAnalysed#861170	Valid	Denial of Service	Low	2020-05-25	–	97
Denial Of Service (Out Of Memory) on Updating Bounty Table [Urgent]Analysed#1043372	Valid	Denial of Service	Low	2021-02-02	–	83
Pixel flood attackAnalysed#390	Valid	Denial of Service	–	2013-11-30	$500	66
GIF floodingAnalysed#400	Valid	Denial of Service	–	2013-11-30	$250	51
Hogging up all the resources on hackerone.comAnalysed#125587	Valid	Denial of Service	Medium	2019-04-10	–	44
The possibility of disrupting the normal operation of frontend using markdownAnalysed#1138668	Valid	Denial of Service	Low	2021-08-24	–	41

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.