Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-25891

CVE-2022-25891: Shoutrrr util package DoS via sending 2000, 4000, or 6000 character messages

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-25891
GHSA ID
GHSA-477v-w82m-634j
EPSS Score
0.35075%
CWE
CWE-400
Published
7/16/2022
Updated
8/29/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/containrrr/shoutrrrgo< 0.6.00.6.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems directly from the PartitionMessage function as shown by: 1) CVE/GHSA descriptions explicitly name this function 2) Commit diff shows critical logic changes in this function's chunk boundary handling 3) Test cases added specifically for 2000/4000/6000 character cases 4) Patch modifies the chunkEnd calculation from 'chunkOffset + limits.ChunkSize' to 'nextChunkStart - 1' to prevent index overflow. The function's role in message splitting makes it the clear entry point for the resource consumption vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** p**k*** `*it*u*.*om/*ont*inrrr/s*outrrr/pk*/util` ***or* *.*.* *r* vuln*r**l* to **ni*l o* S*rvi** (*oS) vi* t** `util.P*rtitionM*ss***` *un*tion. *xploitin* t*is vuln*r**ility is possi*l* *y s*n*in* *x**tly ****, ****, or **** ***r**t*rs m*ss***

Reasoning

T** vuln*r**ility st*ms *ir**tly *rom t** `P*rtitionM*ss***` *un*tion *s s*own *y: *) *V*/**S* **s*riptions *xpli*itly n*m* t*is *un*tion *) *ommit *i** s*ows *riti**l lo*i* ***n**s in t*is *un*tion's **unk *oun**ry **n*lin* *) T*st **s*s ***** sp**i