In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.