# CVE-2022-3290: rdiffweb Denial of Service via unlimited username length

Source: https://junglewise.ai/threats/cve-2022-3290-rdiffweb-denial-of-service-via-unlimited-username-length  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-09-27. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2022-3290 · Severity: high · CVSS 7.5 · Published 2022-09-27

rdiffweb, a web interface for rdiff-backup repositories, is vulnerable to a denial-of-service attack. An attacker can submit an excessively long username during login or registration, which can crash the service or make it unresponsive by consuming all available memory. This prevents legitimate users from accessing their backups and managing their data.

Technologies: [rdiffweb (PyPI)](https://junglewise.ai/threats/technologies/rdiffweb). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-3290 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-3290 being exploited in the wild.

**How severe is CVE-2022-3290?** High severity, with a CVSS score of 7.5, published 27 September 2022.

**Which products and versions are affected?** rdiffweb (PyPI) < 2.4.8, ECOSYSTEM:introduced=0,fixed=2.4.8, GIT:introduced=0,fixed=667657c6fe2b336c90be37f37fb92f65df4feee3|ECOSYSTEM:introduced=0,fixed=2.4.8.

**Is there a fix for CVE-2022-3290?** Yes. rdiffweb (PyPI): upgrade to 2.4.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-3290 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2022-3290?** Check whether you run rdiffweb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- rdiffweb (PyPI): upgrade to 2.4.8 or later

  ```sh
  pip install "rdiffweb>=2.4.8"
  ```


## Technical details

rdiffweb prior to version 2.4.8 fails to validate the length of the 'username' input field. This vulnerability (CWE-130) allows a remote, unauthenticated attacker to send a specially crafted request containing an extremely large username string. Processing this request can lead to excessive memory consumption or memory corruption, resulting in a Denial of Service (DoS) condition. The issue is resolved in version 2.4.8 by implementing field limits for usernames, emails, and root directory paths.

## Affected products

- ikus060 rdiffweb < 2.4.8

## Identifiers

- CVE-2022-3290
- GHSA-5v95-j4rr-6f3c
- PYSEC-2022-292
- PYSEC-2022-43184

## Timeline

- 2022-09-26: advisory: NVD published CVE-2022-3290
- 2022-09-27: disclosed: GitHub Advisory published
- 2022-09-27: patched: Version 2.4.8 released

## References

- [https://github.com/ikus060/rdiffweb/commit/667657c6fe2b336c90be37f37fb92f65df4feee3](https://github.com/ikus060/rdiffweb/commit/667657c6fe2b336c90be37f37fb92f65df4feee3)
- [https://huntr.dev/bounties/d8b8519d-96a5-484c-8141-624c54290bf5](https://huntr.dev/bounties/d8b8519d-96a5-484c-8141-624c54290bf5)
- [https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-292.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-292.yaml)
- [https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-43184.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-43184.yaml)

## Related threats

- [PYSEC-2026-1863 - RDiffWeb vulnerable to Allocation of Resources Without Limits or Throttling](https://junglewise.ai/threats/cve-2023-4138-rdiffweb-vulnerable-to-allocation-of-resources-without-limits-or)
- [PYSEC-2026-3048 - IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users](https://junglewise.ai/threats/cve-2025-67796-ikus-rdiffweb-allows-an-attacker-with-any-valid-or-stolen-access)
- [PYSEC-2023-186 - Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.4.](https://junglewise.ai/threats/cve-2023-5289-rdiffweb-allocation-of-resources-without-limits-or-throttling)
- [PYSEC-2022-43010 - Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.](https://junglewise.ai/threats/cve-2022-4724-rdiffweb-improper-access-control-vulnerability)
- [PYSEC-2022-43008 - Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.](https://junglewise.ai/threats/cve-2022-4722-rdiffweb-vulnerable-to-authentication-bypass-by-primary-weakness)