CVE-2022-24741: nextcloud nextcloud_server Uncontrolled Resource Consumption
Vulnerability summary
CVE-2022-24741 is a medium (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in nextcloud nextcloud_server. EPSS estimates a 1.61% chance of exploitation in the next 30 days, higher than 75.5% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 09-03-2022PublishedVulnerability first disclosed.
- 22-04-2025Last modifiedVulnerability information updated.
Description
Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading specially crafted files which will cause the server to allocate too much memory / CPU. It is recommended that the Nextcloud Server is upgraded to 21.0.8 , 22.2.4 or 23.0.1. Users unable to upgrade should disable preview generation with the `'enable_previews'` config flag.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA3.5LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:LDiffers
EPSS trend
Probability
1.61%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
0.00 pp
From 1.61% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Nextcloud2 products
- nextcloud_serverEOL≥ 21.0.0, < 21.0.8 | ≥ 22.0.0, < 22.2.4 | 23.0.0
- security-advisories< 21.0.8 | ≥ 22.0.0, < 22.2.4 | ≥ 23.0.0, < 23.0.1
1 vendor · 2 products
References
4 links- github.com/nextcloud/security-advisories/security/advisories/GHSA-jf3h-xf4q-mh89X Refsource CONFIRMThird Party Advisory