Vulnerability-Lookup

CVE-2026-28342 (GCVE-0-2026-28342)

Vulnerability from cvelistv5 – Published: 2026-03-05 19:33 – Updated: 2026-03-05 19:33

Title

OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint

Summary

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available container memory, leading to service degradation or complete denial of service (DoS). The issue occurs because the endpoint performs computationally and memory-intensive hashing operations without request throttling, authentication requirements, or resource limits. This issue has been patched in version 3000.10.2.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling
CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M

References

URL

Tags

	https://github.com/OliveTin/OliveTin/security/adv…	x_refsource_CONFIRM
	https://github.com/OliveTin/OliveTin/commit/2eb5f…	x_refsource_MISC
	https://github.com/OliveTin/OliveTin/releases/tag…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	OliveTin	OliveTin	Affected: < 3000.10.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "OliveTin",
          "vendor": "OliveTin",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3000.10.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available container memory, leading to service degradation or complete denial of service (DoS). The issue occurs because the endpoint performs computationally and memory-intensive hashing operations without request throttling, authentication requirements, or resource limits. This issue has been patched in version 3000.10.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-05T19:33:44.300Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp"
        },
        {
          "name": "https://github.com/OliveTin/OliveTin/commit/2eb5f0ba79d4bbef3c802bf8b4666a7e18dcfd90",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OliveTin/OliveTin/commit/2eb5f0ba79d4bbef3c802bf8b4666a7e18dcfd90"
        },
        {
          "name": "https://github.com/OliveTin/OliveTin/releases/tag/3000.10.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.10.2"
        }
      ],
      "source": {
        "advisory": "GHSA-pc8g-78pf-4xrp",
        "discovery": "UNKNOWN"
      },
      "title": "OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-28342",
    "datePublished": "2026-03-05T19:33:44.300Z",
    "dateReserved": "2026-02-26T18:38:13.889Z",
    "dateUpdated": "2026-03-05T19:33:44.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-28342\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-05T20:16:15.837\",\"lastModified\":\"2026-03-05T20:16:15.837\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available container memory, leading to service degradation or complete denial of service (DoS). The issue occurs because the endpoint performs computationally and memory-intensive hashing operations without request throttling, authentication requirements, or resource limits. This issue has been patched in version 3000.10.2.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"},{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://github.com/OliveTin/OliveTin/commit/2eb5f0ba79d4bbef3c802bf8b4666a7e18dcfd90\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/OliveTin/OliveTin/releases/tag/3000.10.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}

GHSA-PC8G-78PF-4XRP

Vulnerability from github – Published: 2026-03-02 18:49 – Updated: 2026-03-05 22:49

Summary

OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint

Details

Summary

The PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available container memory, leading to service degradation or complete denial of service (DoS).

The issue occurs because the endpoint performs computationally and memory-intensive hashing operations without request throttling, authentication requirements, or resource limits.

Details

The vulnerable endpoint:

POST /api/olivetin.api.v1.OliveTinApiService/PasswordHash

accepts a JSON body containing a password field and returns a computed password hash.

Each request triggers a memory-intensive hashing operation. When multiple concurrent requests are sent, memory consumption increases significantly. There are no safeguards such as:

Authentication requirements
Rate limiting
Request throttling
Memory usage caps per request
Concurrency controls

As a result, an attacker can repeatedly invoke the endpoint in parallel, causing excessive RAM allocation inside the container.

In a test environment, 50 concurrent requests resulted in approximately 3.2 GB of memory usage (≈64 MB per request), leading to service instability.

This behavior allows unauthenticated attackers to perform a denial of service attack by exhausting server memory resources.

PoC

Environment

Docker container: olivetin-test
Exposed API on: http://localhost:1337
Default configuration (no authentication enabled)

Reproduction Steps

Run the following script to send 50 concurrent requests:

for i in $(seq 1 50); do
  curl -s -X POST http://localhost:1337/api/olivetin.api.v1.OliveTinApiService/PasswordHash \
    -H "Content-Type: application/json" \
    -d "{\"password\":\"flood-$i\"}" &
done
docker stats olivetin-test --no-stream
wait

┌──(root㉿kali)-[~/cve/OliveTin]
└─# docker stats olivetin-test --no-stream
CONTAINER ID   NAME            CPU %     MEM USAGE / LIMIT     MEM %     NET I/O         BLOCK I/O        PIDS
18509670bf3e   olivetin-test   344.63%   6.189GiB / 7.753GiB   79.83%    313kB / 288kB   4.31MB / 106MB   7

Docker CPU is 344.63%

Impact

This vulnerability allows unauthenticated remote attackers to:

Exhaust server memory
Crash the service
Cause availability loss
Trigger container termination in orchestrated environments

This is a Denial of Service (DoS) vulnerability affecting service availability.

Production deployments without reverse proxy rate limiting (e.g., Nginx, Traefik) are especially at risk.

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/OliveTin/OliveTin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260227002407-2eb5f0ba79d4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28342"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-02T18:49:27Z",
    "nvd_published_at": "2026-03-05T20:16:15Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available container memory, leading to service degradation or complete denial of service (DoS).\n\nThe issue occurs because the endpoint performs computationally and memory-intensive hashing operations without request throttling, authentication requirements, or resource limits.\n\n## Details\n\nThe vulnerable endpoint:\n\n`POST /api/olivetin.api.v1.OliveTinApiService/PasswordHash`\n\naccepts a JSON body containing a password field and returns a computed password hash.\n\nEach request triggers a memory-intensive hashing operation. When multiple concurrent requests are sent, memory consumption increases significantly. There are no safeguards such as:\n\n- Authentication requirements\n- Rate limiting\n- Request throttling\n- Memory usage caps per request\n- Concurrency controls\n\nAs a result, an attacker can repeatedly invoke the endpoint in parallel, causing excessive RAM allocation inside the container.\n\nIn a test environment, 50 concurrent requests resulted in approximately 3.2 GB of memory usage (\u224864 MB per request), leading to service instability.\n\nThis behavior allows unauthenticated attackers to perform a denial of service attack by exhausting server memory resources.\n\n## PoC\nEnvironment\n\n- Docker container: olivetin-test\n- Exposed API on: http://localhost:1337\n- Default configuration (no authentication enabled)\n\n## Reproduction Steps\n\nRun the following script to send 50 concurrent requests:\n\n```bash\nfor i in $(seq 1 50); do\n  curl -s -X POST http://localhost:1337/api/olivetin.api.v1.OliveTinApiService/PasswordHash \\\n    -H \"Content-Type: application/json\" \\\n    -d \"{\\\"password\\\":\\\"flood-$i\\\"}\" \u0026\ndone\ndocker stats olivetin-test --no-stream\nwait\n```\n\n```bash\n\u250c\u2500\u2500(root\u327fkali)-[~/cve/OliveTin]\n\u2514\u2500# docker stats olivetin-test --no-stream\nCONTAINER ID   NAME            CPU %     MEM USAGE / LIMIT     MEM %     NET I/O         BLOCK I/O        PIDS\n18509670bf3e   olivetin-test   344.63%   6.189GiB / 7.753GiB   79.83%    313kB / 288kB   4.31MB / 106MB   7\n\n```\n\n`Docker CPU is 344.63%`\n\n### Impact\n\nThis vulnerability allows unauthenticated remote attackers to:\n\n- Exhaust server memory\n- Crash the service\n- Cause availability loss\n- Trigger container termination in orchestrated environments\n\nThis is a Denial of Service (DoS) vulnerability affecting service availability.\n\nProduction deployments without reverse proxy rate limiting (e.g., Nginx, Traefik) are especially at risk.",
  "id": "GHSA-pc8g-78pf-4xrp",
  "modified": "2026-03-05T22:49:13Z",
  "published": "2026-03-02T18:49:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28342"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/commit/2eb5f0ba79d4bbef3c802bf8b4666a7e18dcfd90"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OliveTin/OliveTin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.10.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-28342 (GCVE-0-2026-28342)

GHSA-PC8G-78PF-4XRP

Summary

Details

PoC

Reproduction Steps

Impact

Tags

Sightings

Nomenclature