Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
profile-picture name parameter with large value lead to DoS for other users and programs on the platformAnalysed#764434	Valid	Denial of Service	–	2020-03-25	–	475
Denial of service via cache poisoningAnalysed#409370	Valid	Denial of Service	–	2018-12-22	$2,500	253
Static files on HackerOne.com can be made inaccessible through Cache Poisoning attackAnalysed#1181946	Valid	Denial of Service	–	2021-12-22	–	228
Uploading large payload on domain instructions causes server-side DoSAnalysed#887321	Valid	Denial of Service	–	2020-06-20	$2,500	210
ActiveStorage throws exception when using whitespace as filename, may lead to denial of service of multiple pages#713407	Valid	Denial of Service	–	2019-12-13	–	111
Attacker with an Old account might still be able to DoS ctf.hacker101.com by sending a Crafted request#861170	Valid	Denial of Service	–	2020-05-25	–	97
Denial Of Service (Out Of Memory) on Updating Bounty Table [Urgent]#1043372	Valid	Denial of Service	–	2021-02-02	–	83
Pixel flood attack#390	Valid	Denial of Service	–	2013-11-30	$500	66
GIF flooding#400	Valid	Denial of Service	–	2013-11-30	$250	51
Hogging up all the resources on hackerone.com#125587	Valid	Denial of Service	–	2019-04-10	–	44
The possibility of disrupting the normal operation of frontend using markdown#1138668	Valid	Denial of Service	–	2021-08-24	–	41
Unicorn worker pool exhaustion by continuously updating payout preferences#317543	Valid	Denial of Service	–	2018-03-30	–	25
Attacker may be able to bounce enough emails which suspend HackerOne's SES service and cause a DoS of HackerOne's email service#823915	Valid	Denial of Service	–	2020-06-12	–	18
Lack of length validation on user address attribute#161947	Valid	Denial of Service	–	2019-04-11	–	18
PNG compression DoS#454	Valid	Denial of Service	–	2015-05-28	$500	18
DOS Report FILE html inside <code> in markdown#127827	Valid	Denial of Service	–	2016-05-21	–	6
Denial of Service any Report#118663	Valid	Denial of Service	–	2016-03-09	–	6
Making any Report Failed to load#59369	Valid	Denial of Service	–	2015-05-09	–	6
attack in not an authorized user#111676	Valid	Denial of Service	–	2016-02-16	–	5
Potential denial of service in hackerone.com/<program>/reward_settings#63865	Valid	Denial of Service	–	2015-06-10	–	5
URL Crashing browser. {Tested on firefox, Chrome and Safari}#39139	Valid	Denial of Service	–	2016-05-25	–	5
Putting link inside link in markdown#115205	Valid	Denial of Service	–	2016-04-02	–	4
Breaking Bugs as team member#38232	Valid	Denial of Service	–	2014-12-09	–	4
Denial of Service#17785	Valid	Denial of Service	–	2015-04-28	$100	4
Potential denial of service in hackerone.com/teams/new#13748	Valid	Denial of Service	–	2014-06-20	–	3
Denial of service in report view.#140720	Informative	Denial of Service	–	2016-05-27	–	2

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.