---
id: CVE-2022-25891
aliases:
  - GHSA-477v-w82m-634j
  - GO-2022-0528
  - SNYK-GOLANG-GITHUBCOMCONTAINRRRSHOUTRRRPKGUTIL-2849059
title: 'Shoutrrr util package DoS via sending 2000, 4000, or 6000 character messages'
summary: 'Shoutrrr util package DoS via sending 2000, 4000, or 6000 character messages'
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: containrrr
product: github.com/containrrr/shoutrrr
ecosystem: go
affected:
  - github.com/containrrr/shoutrrr < 0.6.0
patched:
  - github.com/containrrr/shoutrrr 0.6.0
published: '2022-07-16'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-477v-w82m-634j'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-25891'
  - url: 'https://github.com/containrrr/shoutrrr/issues/240'
  - url: 'https://github.com/containrrr/shoutrrr/pull/242'
  - url: >-
      https://github.com/containrrr/shoutrrr/commit/6a27056f9d7522a8b493216195cb7634bf4b5c42
  - url: 'https://github.com/containrrr/shoutrrr'
  - url: 'https://github.com/containrrr/shoutrrr/releases/tag/v0.6.0'
  - url: 'https://pkg.go.dev/vuln/GO-2022-0528'
  - url: >-
      https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMCONTAINRRRSHOUTRRRPKGUTIL-2849059
tags:
  - osv
  - go
epss: 0.01598
epssPercentile: 0.74726
ingestedAt: '2026-07-09T18:56:35.892Z'
---

## Overview

The package `github.com/containrrr/shoutrrr/pkg/util` before 0.6.0 are vulnerable to Denial of Service (DoS) via the `util.PartitionMessage` function. Exploiting this vulnerability is possible by sending exactly 2000, 4000, or 6000 characters messages.

## Affected packages

- `github.com/containrrr/shoutrrr < 0.6.0`

## Remediation

Upgrade to a patched release:

- `github.com/containrrr/shoutrrr 0.6.0`