# CVE-2022-3371: PYSEC-2022-299 - Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.

Source: https://junglewise.ai/threats/cve-2022-3371-rdiffweb-unvalidated-token-name-length-leads-to-dos  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-09-30. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2022-3371 · Severity: low · CVSS 3.1 · Published 2022-09-30

rdiffweb is a web-based backup client and server used to manage incremental file backups. Due to a lack of length validation on token names, an attacker can submit an extremely long token name that causes the application to allocate excessive memory, resulting in denial of service or memory corruption that crashes the service.

Technologies: [rdiffweb (PyPI)](https://junglewise.ai/threats/technologies/rdiffweb). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-3371 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-3371 being exploited in the wild.

**How severe is CVE-2022-3371?** Low severity, with a CVSS score of 3.1, published 30 September 2022.

**Which products and versions are affected?** rdiffweb (PyPI) ECOSYSTEM:introduced=0,fixed=2.5.0a3, GIT:introduced=0,fixed=b62c479ff6979563c7c23e7182942bc4f460a2c7|ECOSYSTEM:introduced=0,fixed=2.4.10.

**Is there a fix for CVE-2022-3371?** Yes. rdiffweb (PyPI): upgrade to 2.4.10, 2.5.0a3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-3371 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-3371?** Check whether you run rdiffweb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- rdiffweb (PyPI): upgrade to 2.4.10, 2.5.0a3 or later

  ```sh
  pip install "rdiffweb>=2.5.0a3"
  ```


## Technical details

rdiffweb prior to version 2.5.0a3 contains an Allocation of Resources Without Limits or Throttling vulnerability (CWE-770) in its token name parameter. The application fails to enforce a maximum length limit on the token name field, allowing an attacker to send a request with an excessively long token name. This causes uncontrolled memory allocation, leading to denial of service or potential memory corruption. The vulnerability requires network access but no authentication, allowing unauthenticated remote attackers to trigger the issue. The fix limits the length of token name and fullname fields, mitigating resource exhaustion.

## Affected products

- rdiffweb rdiffweb before 2.5.0a3

## Identifiers

- CVE-2022-3371
- GHSA-3fhq-72hw-jqwv
- PYSEC-2022-299

## Timeline

- 2022-10-01: disclosed
- 2022-10-01: patched: Version 2.5.0a3 fixes the issue

## References

- [https://github.com/ikus060/rdiffweb/commit/b62c479ff6979563c7c23e7182942bc4f460a2c7](https://github.com/ikus060/rdiffweb/commit/b62c479ff6979563c7c23e7182942bc4f460a2c7)

## Related threats

- [PYSEC-2026-1863 - RDiffWeb vulnerable to Allocation of Resources Without Limits or Throttling](https://junglewise.ai/threats/cve-2023-4138-rdiffweb-vulnerable-to-allocation-of-resources-without-limits-or)
- [PYSEC-2026-3048 - IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users](https://junglewise.ai/threats/cve-2025-67796-ikus-rdiffweb-allows-an-attacker-with-any-valid-or-stolen-access)
- [PYSEC-2023-186 - Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.4.](https://junglewise.ai/threats/cve-2023-5289-rdiffweb-allocation-of-resources-without-limits-or-throttling)
- [PYSEC-2022-43010 - Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.](https://junglewise.ai/threats/cve-2022-4724-rdiffweb-improper-access-control-vulnerability)
- [PYSEC-2022-43008 - Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.](https://junglewise.ai/threats/cve-2022-4722-rdiffweb-vulnerable-to-authentication-bypass-by-primary-weakness)