Shoutrrr util package DoS via sending 2000, 4000, or 6000 character messages

HOCH 7.5CVE-2022-25891 · GHSA-477v-w82m-634j · GO-2022-0528 · Published 15/07/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-25891 ist eine Schwachstelle (HOCH (CVSS 7.5)) in github.com/containrrr/shoutrrr, shoutrrr (containrrr).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.6%, höher als bei 76.6% aller Schwachstellen.
Abhilfe: auf 0.6.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
github.com/containrrr/shoutrrr Go	`< 0.6.0`	`0.6.0`
shoutrrr containrrr	`< 0.6.0`	`0.6.0`

Description

The package github.com/containrrr/shoutrrr/pkg/util before 0.6.0 are vulnerable to Denial of Service (DoS) via the util.PartitionMessage function. Exploiting this vulnerability is possible by sending exactly 2000, 4000, or 6000 characters messages.

NVD description

The package github.com/containrrr/shoutrrr/pkg/util before 0.6.0 are vulnerable to Denial of Service (DoS) via the util.PartitionMessage function. Exploiting this vulnerability is possible by sending exactly 2000, 4000, or 6000 characters messages.

References

nvd.nist.gov/vuln/detail/CVE-2022-25891 · ADVISORY
containrrr/shoutrrr · WEB
containrrr/shoutrrr#242 · WEB
containrrr/shoutrrr commit 6a27056 · WEB
containrrr/shoutrrr · PACKAGE
containrrr/shoutrrr release v0.6.0 · WEB
pkg.go.dev/vuln/GO-2022-0528 · WEB
snyk.io/vuln/SNYK-GOLANG-GITHUBCOMCONTAINRRRSHOUTRRRPKGUTIL-2849059 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/containrrr/shoutrrr

< 0.6.0

0.6.0

shoutrrr

containrrr

< 0.6.0

0.6.0

Description

NVD description