CVE-2022-2778: Octopus Server

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.

Affected products

• Octopus Octopus Server: from 3.0, before 2022.2.8277 (fixed in 2022.2.8277); from 2022.3.348, before 2022.3.10405 (fixed in 2022.3.10405); from 2022.4.791, before 2022.4.1371 (fixed in 2022.4.1371)

Published 2022-09-30. Last modified 2026-06-17.