In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function.

In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation.

In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template.

In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages.

In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.