CVE-2022-39346

Missing length validation of user displayname in nextcloud server

State: Published
Severity: 3.5 Low
Published: Nov 25, 2022
Updated: Apr 23, 2025
Reserved: Sep 2, 2022

Description

Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.

Scores

CVSS	Score	Vector	Source
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L	GitHub_M

Weaknesses

CWE-400 Uncontrolled Resource Consumption
CWE-20 Improper Input Validation

Affected Products

Product	Versions
security-advisoriesnextcloud	< 22.2.10Affected >= 23.0.0, < 23.0.7Affected >= 24.0.0, < 24.0.3Affected

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6w9f-jgjx-4vj6
https://github.com/nextcloud/server/pull/33052
https://hackerone.com/reports/1588562
FEDORA-2022-902df3b060vendor-advisory
FEDORA-2022-49b20342c0vendor-advisory
FEDORA-2022-98c1d712b5vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.