[Bug]: Text file with a bunch of 'A' s breaks SSE
Open
Nobody has claimed this yet.
0. Needs triage
34-feedback
bug
feature: encryption (server-side)
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
⚠️ This issue respects the following points: ⚠️
- This is a bug, not a question or a configuration/webserver/proxy issue.
- This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
- Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
- I agree to follow Nextcloud's Code of Conduct.
Bug description
When a file with 1048576 (1024*1024) 'A' s is uploaded on a servier-side encryption enabled instance on normal storage (not groupfolders), it opens up fine in the "text" app but fails with a generic error on deletion.
Steps to reproduce
the test file test.txt can be generated with $file->putContent(str_repeat('A', 1024 * 1024));
- do a clean install of NC server (master/v34.0.0)
- enabled encryption (
occ app:enable encryption && occ encryption:enable && occ encryption:enable-master-key) - upload some files through the WebUI so they are encrypted without the
encrypt-allcommand - verify the files on the raw FS are encrypted
- upload the "test.txt" file generated from the above string repeat command
- the test.txt file cannot be deleted from the UI, errors out as file delete failed, the access logs show:
nextcloud-1 | 192.168.21.4 - - [20/Feb/2026:21:37:28 +0000] "DELETE /remote.php/dav/files/admin/test.txt HTTP/1.1" 423 702 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
the only error log, might be unrelated:
{"reqId":"L4RDPlo2tIVuTfAN7ikT","level":2,"time":"2026-02-20T21:20:11+00:00","remoteAddr":"192.168.21.4","user":"admin","app":"PHP","method":"PUT","url":"/remote.php/dav/files/admin/docker%20composer%20resource%20constraints.md","scriptName":"/remote.php","message":"mkdir(): File exists at /var/www/html/lib/private/Files/Storage/Local.php#88","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","version":"34.0.0.0","data":{"app":"PHP"}}
- delete the file from FS and do a
occ files:scan --allto remove it, but cannot re-upload the same test.txt file now, it just goes on increasing the upload ETA with this access log:
nextcloud-1 | 192.168.21.4 - - [20/Feb/2026:21:52:11 +0000] "PUT /remote.php/dav/files/admin/test.txt HTTP/1.1" 423 702 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
nextcloud-1 | 192.168.21.4 - - [20/Feb/2026:21:52:13 +0000] "PUT /remote.php/dav/files/admin/test.txt HTTP/1.1" 423 702 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
nextcloud-1 | 192.168.21.4 - - [20/Feb/2026:21:52:18 +0000] "PUT /remote.php/dav/files/admin/test.txt HTTP/1.1" 423 702 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
nextcloud-1 | 192.168.21.4 - - [20/Feb/2026:21:52:32 +0000] "PUT /remote.php/dav/files/admin/test.txt HTTP/1.1" 423 702 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
nextcloud-1 | 192.168.21.4 - - [20/Feb/2026:21:52:34 +0000] "PUT /remote.php/dav/files/admin/test.txt HTTP/1.1" 423 702 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
nextcloud-1 | 192.168.21.4 - - [20/Feb/2026:21:52:39 +0000] "PUT /remote.php/dav/files/admin/test.txt HTTP/1.1" 423 702 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
nextcloud-1 | 192.168.21.4 - - [20/Feb/2026:21:52:47 +0000] "PUT /remote.php/dav/files/admin/test.txt HTTP/1.1" 423 702 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
nextcloud-1 | 192.168.21.4 - - [20/Feb/2026:21:53:05 +0000] "PUT /remote.php/dav/files/admin/test.txt HTTP/1.1" 423 702 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36"
Expected behavior
the file behaves as any other file
Nextcloud Server version
master
Operating system
Debian/Ubuntu
PHP engine version
PHP 8.3
Web server
Apache (supported)
Database engine version
PostgreSQL
Is this bug present after an update or on a fresh install?
None
Are you using the Nextcloud Server Encryption module?
Encryption is Enabled
What user-backends are you using?
- Default user-backend (database)
- LDAP/ Active Directory
- SSO - SAML
- Other
Configuration report
{
"system": {
"debug": true,
"profiler": true,
"apps_paths": [
{
"path": "\/var\/www\/html\/apps",
"url": "\/apps",
"writable": false
},
{
"path": "\/var\/www\/html\/apps-extra",
"url": "\/apps-extra",
"writable": false
},
{
"path": "\/var\/www\/html\/apps-shared",
"url": "\/apps-shared",
"writable": false
},
{
"path": "\/var\/www\/html\/apps-writable",
"url": "\/apps-writable",
"writable": true
}
],
"allow_local_remote_servers": true,
"mail_from_address": "***REMOVED SENSITIVE VALUE***",
"mail_smtpmode": "smtp",
"mail_sendmailmode": "smtp",
"mail_domain": "***REMOVED SENSITIVE VALUE***",
"mail_smtphost": "***REMOVED SENSITIVE VALUE***",
"mail_smtpport": "1025",
"skeletondirectory": "\/skeleton",
"setup_create_db_user": false,
"loglevel": 2,
"log_query": false,
"query_log_file": "\/shared\/log\/querylog-nextcloud.log",
"query_log_file_requestid": "yes",
"diagnostics.logging": false,
"diagnostics.logging.threshold": 0,
"log.condition": {
"apps": [
"diagnostics",
"admin_audit"
]
},
"passwordsalt": "***REMOVED SENSITIVE VALUE***",
"secret": "***REMOVED SENSITIVE VALUE***",
"trusted_domains": [
"localhost",
"nextcloud",
"nextcloud.nc.ncweb",
"10.0.0.3",
"192.168.21.9",
"localhost"
],
"datadirectory": "***REMOVED SENSITIVE VALUE***",
"dbtype": "mysql",
"version": "34.0.0.0",
"overwrite.cli.url": "http:\/\/nextcloud.nc.ncweb",
"dbname": "***REMOVED SENSITIVE VALUE***",
"dbhost": "***REMOVED SENSITIVE VALUE***",
"dbtableprefix": "oc_",
"mysql.utf8mb4": true,
"dbuser": "***REMOVED SENSITIVE VALUE***",
"dbpassword": "***REMOVED SENSITIVE VALUE***",
"updater.release.channel": "git",
"installed": true,
"instanceid": "***REMOVED SENSITIVE VALUE***",
"lookup_server": "",
"redis": {
"host": "***REMOVED SENSITIVE VALUE***",
"port": 6379
},
"memcache.local": "\\OC\\Memcache\\Redis",
"memcache.locking": "\\OC\\Memcache\\Redis",
"trusted_proxies": "***REMOVED SENSITIVE VALUE***"
}
}
List of activated Apps
Enabled:
- app_api: 34.0.0-dev.0
- circles: 34.0.0-dev.0
- cloud_federation_api: 1.18.0
- comments: 1.24.0
- contactsinteraction: 1.15.0
- context_chat: 5.3.1
- dashboard: 7.14.0
- dav: 1.37.0
- encryption: 2.22.0
- federatedfilesharing: 1.24.0
- federation: 1.24.0
- files: 2.6.0
- files_pdfviewer: 7.0.0-dev.0
- files_reminders: 1.7.0
- files_sharing: 1.26.0
- files_trashbin: 1.24.0
- files_versions: 1.27.0
- lookup_server_connector: 1.22.0
- notifications: 7.0.0-dev.0
- oauth2: 1.22.0
- profile: 1.3.0
- provisioning_api: 1.24.0
- serverinfo: 6.0.0-dev.0
- settings: 1.17.0
- sharebymail: 1.24.0
- systemtags: 1.24.0
- text: 8.0.0-dev.0
- theming: 2.9.0
- twofactor_backupcodes: 1.23.0
- updatenotification: 1.24.0
- user_oidc: 8.4.0
- user_picker: 1.0.0
- user_status: 1.14.0
- viewer: 7.0.0-dev.0
- weather_status: 1.14.0
- webhook_listeners: 1.6.0
- workflowengine: 2.16.0
Disabled:
- admin_audit: 1.24.0
- analytics: 5.2.0
- app-skeleton-python: 3.0.1
- assistant: 3.2.0
- bookmarks: 15.0.5
- collectives: 2.14.4
- contacts: 7.1.0-dev.0
- context_agent: 2.3.0
- context_chat_backend: 5.3.0
- deck: 2.0.0-dev.0
- files_accesscontrol: 2.0.0
- files_antivirus: 6.1.0-dev.1
- files_automatedtagging: 3.0.1
- files_external: 1.26.0
- files_retention: 4.0.0-dev.0
- groupfolders: 20.0.0
- hmr_enabler: 1.0.0
- integration_deepl: 1.3.0
- integration_discourse: 3.0.0
- integration_giphy: 1.0.10
- integration_github: 3.2.2
- integration_gitlab: 3.1.3
- integration_mattermost: 2.1.1
- integration_openai: 3.10.0
- integration_peertube: 2.1.0
- integration_replicate: 1.0.7
- integration_slack: 3.1.0
- integration_youtube: 0.7.0
- live_transcription: 2.0.0
- llm2: 2.5.0
- memegen: 2.0.0
- profiler: 1.5.0
- recognize: 4.3.0
- richdocuments: 9.0.2
- security_guard: 2.3.0
- spreed: 24.0.0-dev.1
- stt_helper: 1.1.1
- stt_whisper: 1.0.8
- stt_whisper2: 2.3.0
- summary_bot: 1.1.6
- testing: 1.24.0
- text_templates: 1.1.0
- translate2: 2.3.0
- user_ldap: 1.25.0
- workflow_pdf_converter: 3.0.0-dev.0
Nextcloud Signing status
Integrity checker has been disabled. Integrity cannot be verified.
Nextcloud Logs
Additional info
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with the encryption module enabled and the generated 1 MiB test.txt file, using the DAV PUT and DELETE requests described in the report. Trace the resulting 423 responses through the encryption and file-storage paths. Done means the encrypted file can be uploaded, opened, deleted, and re-uploaded normally.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100