Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
profile-picture name parameter with large value lead to DoS for other users and programs on the platformAnalysed#764434	Valid	Denial of Service	Medium	2020-03-25	–	475
Denial of service via cache poisoningAnalysed#409370	Valid	Denial of Service	Medium	2018-12-22	$2,500	253
Static files on HackerOne.com can be made inaccessible through Cache Poisoning attackAnalysed#1181946	Valid	Denial of Service	Medium	2021-12-22	–	228
Uploading large payload on domain instructions causes server-side DoSAnalysed#887321	Valid	Denial of Service	Medium	2020-06-20	$2,500	210
DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification APIAnalysed#3287208	Valid	No weakness recorded	–	2026-04-16	–	185
ActiveStorage throws exception when using whitespace as filename, may lead to denial of service of multiple pagesAnalysed#713407	Valid	Denial of Service	Medium	2019-12-13	–	111
How the Arch Angel stole Live EventsAnalysed#2285198	Valid	No weakness recorded	None	2023-12-15	–	98
Attacker with an Old account might still be able to DoS ctf.hacker101.com by sending a Crafted requestAnalysed#861170	Valid	Denial of Service	Low	2020-05-25	–	97
Denial Of Service (Out Of Memory) on Updating Bounty Table [Urgent]Analysed#1043372	Valid	Denial of Service	Low	2021-02-02	–	83
Near to Infinite loop when changing Group's name that has API token as Team MemberAnalysed#880187	Valid	No weakness recorded	Medium	2020-07-23	$2,500	77
Pixel flood attackAnalysed#390	Valid	Denial of Service	–	2013-11-30	$500	66
2M Reports on HackerOne Celebration! - Ability to bulk-submit many reports.Analysed#2000000	Valid	Misconfiguration and Insecure Design	Low	2023-07-11	–	54
GIF floodingAnalysed#400	Valid	Denial of Service	–	2013-11-30	$250	51
Hogging up all the resources on hackerone.comAnalysed#125587	Valid	Denial of Service	Medium	2019-04-10	–	44
The possibility of disrupting the normal operation of frontend using markdownAnalysed#1138668	Valid	Denial of Service	Low	2021-08-24	–	41
Ability to bulk submit reports via query named based batchingAnalysed#2166697	Valid	Misconfiguration and Insecure Design	Low	2024-06-19	$500	37

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,942 analysed so far), which can be wrong. Data as of 2026-11-15.