CVE-2022-29243

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance. Versions 22.2.7 and 23.0.4 contain a fix for this issue. There are currently no known workarounds available.

• CWE-20
• CWE-400

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7cwm-qph5-4h5wThird Party Advisory
• https://github.com/nextcloud/server/pull/31658Patch, Third Party Advisory
• https://hackerone.com/reports/1153138Third Party Advisory
• https://security.gentoo.org/glsa/202208-17Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7cwm-qph5-4h5wThird Party Advisory
• https://github.com/nextcloud/server/pull/31658Patch, Third Party Advisory
• https://hackerone.com/reports/1153138Third Party Advisory
• https://security.gentoo.org/glsa/202208-17Third Party Advisory

Published

May 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29237Opencast is a free and open source solution for automated vi…5.4
• CVE-2022-29238Jupyter Notebook is a web-based notebook environment for int…4.3
• CVE-2022-2924Cross-site Scripting (XSS) - Stored in GitHub repository yet…5.4
• CVE-2022-29240Scylla is a real-time big data database that is API-compatib…8.1
• CVE-2022-29241Jupyter Server provides the backend (i.e. the core services,…8.8
• CVE-2022-29242GOST engine is a reference implementation of the Russian GOS…7.5
• CVE-2022-29244npm pack ignores root-level .gitignore and .npmignore file e…7.5
• CVE-2022-29245SSH.NET is a Secure Shell (SSH) library for .NET. In version…5.9
• CVE-2022-29246Azure RTOS USBX is a USB host, device, and on-the-go (OTG) e…9.8
• CVE-2022-29247Electron is a framework for writing cross-platform desktop a…9.8
• CVE-2022-29248Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 …8.1
• CVE-2022-29249JavaEZ is a library that adds new functions to make Java eas…7.5