Skip to content
OpenAdvisories
Critical · 9.8 CVE-2022-2778 EUVD-2022-35019GHSA-xh2c-fh83-6hgx

In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.

Published Sep 30, 2022 · Updated May 20, 2025 · Assigned by Octopus

Vendor: Octopus Deploy Product: Octopus Server

Description

In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.

Affected products

VendorProductAffectedFixed
Octopus Deploy Octopus Server 3.0 – < unspecified, unspecified – < 2022.2.8277, 2022.3.348 – < unspecified, unspecified – < 2022.3.10586, 2022.4.791 – < unspecified, unspecified – < 2022.4.1371 unspecified

References