{"id":"CVE-2022-25891","aliases":["GHSA-477v-w82m-634j","GO-2022-0528","SNYK-GOLANG-GITHUBCOMCONTAINRRRSHOUTRRRPKGUTIL-2849059"],"title":"Shoutrrr util package DoS via sending 2000, 4000, or 6000 character messages","summary":"Shoutrrr util package DoS via sending 2000, 4000, or 6000 character messages","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"containrrr","product":"github.com/containrrr/shoutrrr","ecosystem":"go","affected":["github.com/containrrr/shoutrrr < 0.6.0"],"patched":["github.com/containrrr/shoutrrr 0.6.0"],"published":"2022-07-16","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-477v-w82m-634j","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25891"},{"url":"https://github.com/containrrr/shoutrrr/issues/240"},{"url":"https://github.com/containrrr/shoutrrr/pull/242"},{"url":"https://github.com/containrrr/shoutrrr/commit/6a27056f9d7522a8b493216195cb7634bf4b5c42"},{"url":"https://github.com/containrrr/shoutrrr"},{"url":"https://github.com/containrrr/shoutrrr/releases/tag/v0.6.0"},{"url":"https://pkg.go.dev/vuln/GO-2022-0528"},{"url":"https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMCONTAINRRRSHOUTRRRPKGUTIL-2849059"}],"tags":["osv","go"],"epss":0.01598,"epssPercentile":0.7471,"ingestedAt":"2026-07-09T18:56:35.892Z","slug":"CVE-2022-25891","body":"## Overview\n\nThe package `github.com/containrrr/shoutrrr/pkg/util` before 0.6.0 are vulnerable to Denial of Service (DoS) via the `util.PartitionMessage` function. Exploiting this vulnerability is possible by sending exactly 2000, 4000, or 6000 characters messages.\n\n## Affected packages\n\n- `github.com/containrrr/shoutrrr < 0.6.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/containrrr/shoutrrr 0.6.0`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}