GHSA-fqfg-c577-2vc3MediumCVSS 5.3

rdiffweb's unlimited length Fullname field can lead to DoS

Published
September 30, 2022
Last Modified
October 25, 2024

🔗 CVE IDs covered (1)

CVE-2022-3364 →

📋 Description

rdiffweb prior to 2.5.0a3 does not validate email length, allowing users to insert an email longer than 255 characters. If a user signs up with an email with a length of 1 million or more characters and logs in, withdraws, or changes their email, the server may cause denial of service due to overload.

🎯 Affected products1

  • pip/rdiffweb:< 2.5.0a3

🔗 References (5)