GHSA-qrj3-hrgj-fm7r CVE-2022-3272 PYSEC-2022-291

rdiffweb's unlimited length email field can lead to DoS

High PyPI

Severity: 7.5 / 10; High · CVSS 3.1
Exploit chance (EPSS): 1.77%; Chance of exploitation in the next 30 days. Higher than 78.16% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-130 Improper Handling of Length Parameter Inconsistency
Fix: 2.4.8; Upgrade rdiffweb to this version or later

Description

rdiffweb prior to 2.4.8 does not validate email length, allowing users to insert an email longer than 255 characters. If a user signs up with an email with a length of 1 million or more characters and logs in, withdraws, or changes their email, the server may cause denial of service due to overload. Version 2.4.8 sets length limits for username, email, and root directory.

Affected versions

PyPI

Package	Vulnerable	Fixed in
rdiffweb	`< 2.4.8`	`2.4.8`
rdiffweb	`< 2.4.8`	`2.4.8`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

rdiffweb PyPI → `2.4.8`

pip

pip install --upgrade "rdiffweb>=2.4.8"

poetry

poetry add "rdiffweb>=2.4.8"

uv

uv add "rdiffweb>=2.4.8"

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Weakness

CWE-130: Improper Handling of Length Parameter Inconsistency

The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

How to prevent it

Implementation: When processing structured incoming data containing a size field followed by raw data, ensure that you identify and resolve any inconsistencies between the size field and the actual size of the data.
Implementation: Do not let the user control the size of the buffer.
Implementation: Validate that the length of the user-supplied data is consistent with the buffer size.

References

Advisories

Packages

github.com/ikus060/rdiffweb

Timeline

Sep 26, 2022 Published
Jun 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-v4gp-hf5j-4566 IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users	High	Also affects rdiffweb
GHSA-c4rv-2j6x-pq7x Rdiffweb Allocation of Resources Without Limits or Throttling vulnerability	High	Also affects rdiffweb
GHSA-wwrg-2w5j-grvx RDiffWeb vulnerable to Allocation of Resources Without Limits or Throttling	Medium	Also affects rdiffweb
GHSA-wf33-6x33-wcf9 rdiffweb vulnerable to Authentication Bypass by Primary Weakness	High	Also affects rdiffweb
GHSA-m8r9-qxx8-mrxp rdiffweb Improper Access Control vulnerability	Critical	Also affects rdiffweb
GHSA-h5wp-jrqc-cwwx rdiffweb vulnerable to Open Redirect	High	Also affects rdiffweb
GHSA-83pm-7v48-5jp4 rdiffweb vulnerable to Special Element Injection	Medium	Also affects rdiffweb
GHSA-7q4r-x5qg-mmcp rdiffweb has no rate limit on resend email feature	Medium	Also affects rdiffweb

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor