CVE-2022-2049

Published: Aug 19, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function.

Affected (12)

Products: Octopus: Octopus Server

1 product

Configuration A

12 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Octopus Octopus Server	From 0.9 to 0.9.620.4
Octopus Octopus Server	From 1.0 to 1.6.3.1723
Octopus Octopus Server	From 2.0 to 2.6.5
Octopus Octopus Server	From 2018.1.0 to 2018.12.1
Octopus Octopus Server	From 2019.1.0 to 2019.13.7
Octopus Octopus Server	From 2020.1.0 to 2020.6.5449
Octopus Octopus Server	From 2021.1.6959 to 2021.3.13021
Octopus Octopus Server	From 2022.1.0 to 2022.1.2894
Octopus Octopus Server	From 2022.2.6729 to 2022.2.6872
Octopus Octopus Server	From 2022.3.348 to 2022.3.4953
Octopus Octopus Server	From 3.0.0 to 3.17.14
Octopus Octopus Server	From 4.0.4 to 4.1.10

Running on/with	Platform Versions
Linux Linux Kernel	All versions
Microsoft Windows	All versions

References (2)

https://advisories.octopus.com/post/2022/sa2022-10/

Source: security@octopus.com

MitigationPatchVendor Advisory

https://advisories.octopus.com/post/2022/sa2022-10/

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationPatchVendor Advisory

Timeline

No history available yet.