CVE-2022-29243 Improper input-size validation on the user new session name in Nextcloud Server

Medium 4.3 Published 31 May 2022 Updated 23 Apr 2025

Attackers can degrade Nextcloud Server performance by creating app passwords with excessively long names, requiring an upgrade to fix.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-29243?

CVE-2022-29243 is a medium-severity denial of service vulnerability in Nextcloud Nextcloud Server, published on 31 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance. Versions 22.2.7 and 23.0.4 contain a fix for this issue. There are currently no known workarounds available.

Weakness: CWE-400, CWE-20

Which versions are affected by CVE-2022-29243?

It affects 1 product.

Products include Nextcloud Nextcloud Server.

How do I fix CVE-2022-29243?

No fix has been published for CVE-2022-29243 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-29243 being exploited?

There is no known exploitation of CVE-2022-29243 in the wild and no public exploit code.

All Nextcloud Nextcloud Server vulnerabilities

Sources

Also known as GHSA-7cwm-qph5-4h5w.