What’s Vulnerable › Vulnerabilities

CVE-2022-39330: Database resource exhaustion for logged-in users via sharee recommendations with circles

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-27 · updated 2026-06-17
• Weakness: CWE-400

Description

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versions 22.2.10, 23.0.10, and 24.0.6 are vulnerable to a logged-in attacker slowing down the system by generating a lot of database/cpu load. Nextcloud Server versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server versions 22.2.10, 23.0.10, and 24.0.6 contain patches for this issue. As a workaround, disable the Circles app.

Affected products

• Nextcloud Enterprise Server: before 22.2.10; from 23.0.0 before 23.0.10; from 24.0.0 before 24.0.6 — fixed in 22.2.10, 23.0.10, 24.0.6
• Nextcloud Server: before 23.0.10; from 24.0.0 before 24.0.6 — fixed in 23.0.10, 24.0.6

How to fix

Upgrade to a fixed version: Nextcloud Enterprise Server 22.2.10, 23.0.10, 24.0.6; Nextcloud Server 23.0.10, 24.0.6. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/circles/pull/1147
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wxx7-w5p4-7x4c
• https://hackerone.com/reports/1688199
• https://github.com/nextcloud/circles/pull/1147
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wxx7-w5p4-7x4c
• https://hackerone.com/reports/1688199

Get alerted when CVE-2022-39330 or the next vulnerability affects your stack