CVE-2022-25891

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The package github.com/containrrr/shoutrrr/pkg/util before 0.6.0 are vulnerable to Denial of Service (DoS) via the util.PartitionMessage function. Exploiting this vulnerability is possible by sending exactly 2000, 4000, or 6000 characters messages.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
n/a	github.com/containrrr/shoutrrr/pkg/util	>= unspecified, < 0.6.0

References

https://github.com/containrrr/shoutrrr/commit/6a27056f9d7522a8b493216195cb7634bf4b5c42Patch, Third Party Advisory
https://github.com/containrrr/shoutrrr/issues/240Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/containrrr/shoutrrr/pull/242Patch, Third Party Advisory
https://github.com/containrrr/shoutrrr/releases/tag/v0.6.0Release Notes, Third Party Advisory
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMCONTAINRRRSHOUTRRRPKGUTIL-2849059Patch, Third Party Advisory
https://github.com/containrrr/shoutrrr/commit/6a27056f9d7522a8b493216195cb7634bf4b5c42Patch, Third Party Advisory
https://github.com/containrrr/shoutrrr/issues/240Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/containrrr/shoutrrr/pull/242Patch, Third Party Advisory
https://github.com/containrrr/shoutrrr/releases/tag/v0.6.0Release Notes, Third Party Advisory
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMCONTAINRRRSHOUTRRRPKGUTIL-2849059Patch, Third Party Advisory

Timeline

Published: Jul 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-258927.5The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) wh CVE-2022-258939.8The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set CVE-2022-258949.8All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via je CVE-2022-258957.5All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed CVE-2022-258964.8This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.CVE-2022-258977.5The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive CVE-2022-258989.8The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non B CVE-2022-258999.8Authentication bypass for the Open AMT Cloud Toolkit software maintained by Intel(R) before versions 2.0.2 and 2.2.2 may allow an unauthenti CVE-2022-25907.0A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shar CVE-2022-259009.8All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the --upload-pack feature of git.CVE-2022-259017.5Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function,CVE-2022-259037.5The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) via the ExtensionObjects and Variants objects, when it allows unlimit