Shoutrrr util package DoS via sending 2000, 4000, or 6000 character messages

ALTO 7.5CVE-2022-25891 · GHSA-477v-w82m-634j · GO-2022-0528 · Published 15/07/2022 · updated 17/06/2026

In breve

CVE-2022-25891 è una vulnerabilità ALTO (CVSS 7.5) che riguarda github.com/containrrr/shoutrrr, shoutrrr (containrrr).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.6%, superiore al 76.6% delle vulnerabilità.
Correzione: aggiornare a 0.6.0 o successiva.

Package	Affected versions	Patched versions
github.com/containrrr/shoutrrr Go	`< 0.6.0`	`0.6.0`
shoutrrr containrrr	`< 0.6.0`	`0.6.0`

Description

The package github.com/containrrr/shoutrrr/pkg/util before 0.6.0 are vulnerable to Denial of Service (DoS) via the util.PartitionMessage function. Exploiting this vulnerability is possible by sending exactly 2000, 4000, or 6000 characters messages.

NVD description

The package github.com/containrrr/shoutrrr/pkg/util before 0.6.0 are vulnerable to Denial of Service (DoS) via the util.PartitionMessage function. Exploiting this vulnerability is possible by sending exactly 2000, 4000, or 6000 characters messages.

References

nvd.nist.gov/vuln/detail/CVE-2022-25891 · ADVISORY
containrrr/shoutrrr · WEB
containrrr/shoutrrr#242 · WEB
containrrr/shoutrrr commit 6a27056 · WEB
containrrr/shoutrrr · PACKAGE
containrrr/shoutrrr release v0.6.0 · WEB
pkg.go.dev/vuln/GO-2022-0528 · WEB
snyk.io/vuln/SNYK-GOLANG-GITHUBCOMCONTAINRRRSHOUTRRRPKGUTIL-2849059 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/containrrr/shoutrrr

< 0.6.0

0.6.0

shoutrrr

containrrr

< 0.6.0

0.6.0

Description

NVD description