HexBrain

Hiro · Report #304073

Missing restriction on string size of Full Name at browser.blockstack.org

Informativestatus
12upvotes
31 Oct 2025disclosed

How it was found

Hi there

Vulnerability Title: During my regular testing, I have found that there was no restriction on the amount of text that can be inserted into a user's Full name field.

Security Impact: When the text size was large enough the service resulting in a momentary outage in our non-production environment (not high-availability). An internal reproduction showed isolated disruption but no outage in our production environment.

Mitigation: To mitigate, please restrict limit of user input field of Full name like you have already enforced on the fields E-mail and User name.

If you need more info, be free to ask.

Happy to help.

Regards,

drougj

Impact

When the text size was large enough the service resulting in a momentary outage in our non-production environment (not high-availability). An internal reproduction showed isolated disruption but no outage in our production environment.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original