Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion#1043360	Valid	Denial of Service	Critical	2021-03-15	–	3
Denial of Service: nghttp2 use of uninitialized pointer#335608	Valid	Memory Corruption	Critical	2020-02-13	–	4
Unexpected input validation of octal literals in nodejs v15.12.0 and below returns defined values for all undefined octal literals.#1141623	N/A	Memory Corruption	Critical	2021-06-14	–	4
Your page has 2 blocking CSS resources. This causes a delay in rendering your page.#365968	N/A	Memory Corruption	Critical	2018-07-15	–	8
Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests#868834	Valid	Denial of Service	Critical	2020-10-17	$250	8
Malformed HTTP/2 SETTINGS frame leads to reachable assert#800140	Valid	Denial of Service	Critical	2020-07-03	$250	14
Remotely trigger an assertion on a TLS server with a malformed certificate string#746733	Valid	Cryptography	Critical	2020-02-06	–	15
HTTP request smuggling using malformed Transfer-Encoding headerAnalysed#735748	Valid	Injection and Smuggling	Critical	2020-03-07	–	105

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,942 analysed so far), which can be wrong. Data as of 2026-11-15.