Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, the uploadViaURL path in the v1/v2 attachment API did not enforce NC_ATTACHMENT_FIELD_SIZE against the remote content-length or against the response stream. An authenticated user (Editor+) could direct the server to download arbitrarily large files, exhausting disk space and causing denial of service. In packages/nocodb/src/services/attachments.service.ts, the HEAD probe read content-length but never compared it to NC_ATTACHMENT_FIELD_SIZE; the subsequent storageAdapter.fileCreateByUrl() performed the download without maxContentLength. This vulnerability is fixed in 2026.04.4.
Published: 2026-06-23
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in NocoDB enables an authenticated user with Editor+ privileges to trigger the server to download files of any size from external URLs through the uploadViaURL endpoint. Because the endpoint does not check the remote content‑length or response stream against the configured maximum attachment size (NC_ATTACHMENT_FIELD_SIZE), the download can consume all available disk space, causing the application to become unavailable. This flaw is a classic example of resource exhaustion (CWE‑770).

Affected Systems

NocoDB versions prior to 2026.04.4 are affected. The vulnerability occurs in the uploadViaURL endpoint of the v1/v2 attachment API and affects any deployment that uses this feature.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity. No EPSS information is available and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated with Editor+ privileges to exercise the vulnerability, making the threat most likely to arise from compromised credentials or misuse by a legitimate user. The impact is restricted to the server’s disk space, resulting in a denial of service.

Generated by OpenCVE AI on June 24, 2026 at 09:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade NocoDB to version 2026.04.4 or later.
  • Configure your attachment service to enforce a maximum download size corresponding to NC_ATTACHMENT_FIELD_SIZE.
  • Deploy disk‑space monitoring and alerts to detect early exhaustion and respond before the service is taken down.

Generated by OpenCVE AI on June 24, 2026 at 09:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-99vc-2jx2-688p NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion
History

Wed, 24 Jun 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 24 Jun 2026 01:30:00 +0000

Type Values Removed Values Added
First Time appeared Nocodb
Nocodb nocodb
Vendors & Products Nocodb
Nocodb nocodb

Tue, 23 Jun 2026 21:15:00 +0000

Type Values Removed Values Added
Description NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, the uploadViaURL path in the v1/v2 attachment API did not enforce NC_ATTACHMENT_FIELD_SIZE against the remote content-length or against the response stream. An authenticated user (Editor+) could direct the server to download arbitrarily large files, exhausting disk space and causing denial of service. In packages/nocodb/src/services/attachments.service.ts, the HEAD probe read content-length but never compared it to NC_ATTACHMENT_FIELD_SIZE; the subsequent storageAdapter.fileCreateByUrl() performed the download without maxContentLength. This vulnerability is fixed in 2026.04.4.
Title NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Nocodb Nocodb
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-06-24T13:57:19.738Z

Reserved: 2026-05-14T20:42:31.369Z

Link: CVE-2026-46551

cve-icon Vulnrichment

Updated: 2026-06-24T13:57:17.054Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-24T10:00:05Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling