CVE-2026-77165
Description
A flaw was found in Nextcloud Server's file locking mechanism. An authenticated remote attacker could place a TYPE_TOKEN lock on files, preventing their owners from unlocking them. This vulnerability leads to a permanent denial of service, as affected files become inaccessible with no recovery path outside of the database.
Statement
This vulnerability affects Nextcloud Server versions 32.0.0 through 34.0.0 and was fixed in version 34.0.1. Red Hat does not ship Nextcloud Server in any supported product.
Community products (Fedora, EPEL) that reference Nextcloud are not affected:
- The nextcloud package in Fedora and EPEL ships version 34.0.5, which includes the fix for this vulnerability.
- The nextcloud-client packages are desktop synchronization clients, not the Nextcloud Server application, and are therefore not affected by this server-side vulnerability.
- The forgejo package bundles an OAuth provider library (github.com/markbates/goth/providers/nextcloud) for authenticating with Nextcloud servers, but does not include the Nextcloud Server application itself.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other)
When an attacker can control a lock, the program may wait indefinitely until the attacker releases the lock, causing a denial of service to other users of the program. This is especially problematic if there is a blocking operation on the lock.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
