As per RFC the maximum length allowed for an email address is 255 characters. However, rdiffweb don’t validate email length, so you can add email addresses that exceed 255 characters. Through this, if you sign up for an email with a length of 1 million or more and log in, withdraw, or change your email, the server may cause DOS due to overload.
Mitigation: The email parameter must have a specific user input length