CVE-2026-77167
Description
A flaw was found in Nextcloud. An unauthenticated remote attacker can abuse the federated sharing endpoint to inject arbitrary rows into the database. Because these entries are never automatically cleaned up, they cause persistent Denial of Service (DoS) conditions that disrupt system availability.
Statement
Red Hat Product Security rates this vulnerability as Important because an unauthenticated remote attacker can exploit public federated sharing interfaces to cause recurring denial of service without requiring user interaction or specialized privileges. Nextcloud is not included or supported within core Red Hat Enterprise Linux products, though packages are available in community repositories like Fedora and EPEL. Systems exposing federation capabilities face persistent availability degradation due to unbounded database table bloat.
Mitigation
--- CME Mitigation Guidance (2026-11-03) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to throttle or block unauthenticated HTTP requests targeting the Nextcloud federated sharing endpoint to prevent arbitrary row insertion into oc_share_external: upgrade to the fixed Nextcloud builds, which apply the documented input check, closing unauthenticated federated share endpoint abuse. Until patched, this is a concern on Nextcloud instances with federated sharing enabled and accessible over the network, so Disable federated sharing or restrict network access to the federated sharing endpoint, and monitor or prune injected rows from the oc_share_external database table. These controls limit blast radius and contain exploitation, but they do not fix the underlying uncontrolled resource consumption defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-906 Rate Limiting / Connection Throttling (high)
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
