Description
Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nextcloud | security-advisories | < 22.2.10, >= 23.0.0, < 23.0.7, >= 24.0.0, < 24.0.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP4 | nextcloud | 23.0.12-bp154.2.3.1 | openSUSE-SU-2023:0083-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | nextcloud | 23.0.12-bp154.2.3.1 | openSUSE-SU-2023:0083-1 |
Advisories 2
- openSUSE-SU-2023:0083-1 Security update for nextcloud SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-2183 Nextcloud: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2025