# Uploading large avatar images cause excessive CPU usage

Uploading a large avatar image triggers a VCard property-splitting loop in Nextcloud 13/14, pinning php-fpm workers at 100% CPU until the server is overloaded.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by: fancycode
- Disclosed: 2019-06-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/504759
- Library page: https://bugbountylibrary.com/r/h1%3A504759
- Tags: area:web domain:web impact:dos impact:mass-exploit kind:bounty platform:hackerone sev:medium tech:php vuln:dos

**Target:** Avatar upload endpoint / personal settings (PHP-FPM backend, 3rdparty VCard library)
**Root cause:** The 3rdparty VCard code splits property values at 75 characters; a large avatar image produces a value that causes this splitting to loop, consuming CPU indefinitely.
**Steps:**
1. Create an account on a server running Nextcloud 13 or 14.
2. Open personal settings.
3. Upload a large image as avatar (tested with a 4032x3024 PNG, ~14.5 MB).
4. Keep the selected area in the popup and save the avatar.
5. Observe the avatar spinner never resolves and a php-fpm process hits 100% CPU.
6. Reload the browser; avatar appears but php-fpm stays at 100% CPU.
7. Repeat the upload until all php-fpm processes are saturated or the server is overloaded.
**How found:** Noticed the avatar spinner never completed and a php-fpm process stayed at 100% CPU after upload; traced the cause to the 3rdparty VCard code splitting property values at 75 characters.
**Exploitation:** An authenticated user repeatedly uploads large avatar images; each upload leaves a php-fpm worker spinning at 100% CPU indefinitely, and repetition saturates all workers, denying service to the whole server.
**Escalation:** Repeating the upload across workers escalates from a single stuck process to full server unavailability.
**Insight:** Large binary blobs passed into text-format encoders (VCard/vCard property folding) can trigger pathological loops; test oversized avatar/contact uploads and watch backend worker CPU.