{"id":"CVE-2022-3290","aliases":["GHSA-5v95-j4rr-6f3c","PYSEC-2022-292"],"title":"rdiffweb's unlimited username field length can lead to DoS","summary":"rdiffweb's unlimited username field length can lead to DoS","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"rdiffweb","product":"rdiffweb","ecosystem":"pip","affected":["rdiffweb < 2.4.8"],"patched":["rdiffweb 2.4.8"],"published":"2022-09-27","updated":"2026-07-09","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-5v95-j4rr-6f3c","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3290"},{"url":"https://github.com/ikus060/rdiffweb/commit/667657c6fe2b336c90be37f37fb92f65df4feee3"},{"url":"https://github.com/ikus060/rdiffweb"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-292.yaml"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-43184.yaml"},{"url":"https://huntr.dev/bounties/d8b8519d-96a5-484c-8141-624c54290bf5"}],"tags":["osv","pip"],"epss":0.00769,"epssPercentile":0.54115,"ingestedAt":"2026-07-09T18:56:35.190Z","slug":"CVE-2022-3290","body":"## Overview\n\nrdiffweb prior to 2.4.8 is vulnerable to a potential Dos attack via an unlimited length \"username\" field. This can result in excess memory consumption, or memory corruption, leading to a Denial of Service (DoS). This issue is patched in version 2.4.8. There are no known workarounds.\n\n## Affected packages\n\n- `rdiffweb < 2.4.8`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `rdiffweb 2.4.8`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}