Read the docs
TI-2022-01921 Aliases CVE-2022-2074GHSA-93fh-49m9-64cj

In affected versions of Octopus Deploy it is possible to perform a Regex Denial of…

Priority LOW 35Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template.

Why it matters now

EPSS 0.00893 59th percentileScored 2026-11-07
Fix Fixed Octopus Server (Octopus Deploy): 2022.1.2894, 2022.2.6872, 2022.3.4953

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Octopus DeployOctopus Server0.9 and later; before 2022.1.2894; 2022.2.6729 and later; before 2022.2.6872; 2022.3.348 and later; before 2022.3.49532022.1.2894, 2022.2.6872, 2022.3.4953Patch availableCNA
  • Octopus Server VendorOctopus Deploy Affected 0.9 and later; before 2022.1.2894; 2022.2.6729 and later; before 2022.2.6872; 2022.3.348 and later; before 2022.3.4953 Fixed in 2022.1.2894, 2022.2.6872, 2022.3.4953 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*0.9 – 0.9.620.4; 1.0 – 1.6.3.1723; 2.0 – 2.6.5; 3.0.0 – 3.17.14; 4.0.4 – 4.1.10; 2018.1.0 – 2018.12.1; 2019.1.0 – 2019.13.7; 2020.1.0 – 2020.6.5449; 2021.1.6959 – 2021.3.13021; 2022.1.0 to before 2022.1.2894; 2022.2.6729 to before 2022.2.6872; 2022.3.348 to before 2022.3.4953VulnerableOctopus Deploy
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:* Versions 0.9 – 0.9.620.4; 1.0 – 1.6.3.1723; 2.0 – 2.6.5; 3.0.0 – 3.17.14; 4.0.4 – 4.1.10; 2018.1.0 – 2018.12.1; 2019.1.0 – 2019.13.7; 2020.1.0 – 2020.6.5449; 2021.1.6959 – 2021.3.13021; 2022.1.0 to before 2022.1.2894; 2022.2.6729 to before 2022.2.6872; 2022.3.348 to before 2022.3.4953 Vulnerable ·Octopus Deploy
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA Octopus Server (Octopus Deploy) Fixed in 2022.1.2894, 2022.2.6872, 2022.3.4953

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Octopus Server 2022.1.2894, 2022.2.6872 and 2 more versions

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2022-01922 In affected versions of Octopus Deploy it is possible to perform a Regex Denial of…Priority LOW 34
    • TI-2022-01898 In affected versions of Octopus Deploy it is possible to perform a Regex Denial of…Priority LOW 34
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2074
  2. 2026-10-03 Alias added: GHSA-93fh-49m9-64cj

References

Patch 1

  • TI-2018-13353 In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with… CVSS 3.0HIGH 8.8
  • TI-2022-02375 Improper authentication in Octopus Server CVSS 3.1CRITICAL 9.8
  • TI-2022-02579 Insufficient session expiration in Octopus Server CVSS 3.1CRITICAL 9.1
  • TI-2018-08066 In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the… CVSS 3.0CRITICAL 9.8
  • TI-2022-02575 In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. CVSS 3.1CRITICAL 9.8
  • TI-2022-03678 In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation CVSS 3.1HIGH 8.8
See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences