EUVD-2026-50563
GHSA-xpxj-f2fm-rqch
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Pre-auth network endpoint reachable without interaction (PR:N/UI:N/AV:N/AC:L); pure memory-exhaustion DoS gives A:H with no confidentiality or integrity impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or bounding entries, allowing an unauthenticated attacker to exhaust memory and cause a denial of service. This issue is fixed in version 3000.17.0.
AnalysisAI
Memory-exhaustion denial of service in OliveTin (versions 3000.0.0 through 3000.16.x) allows a remote unauthenticated attacker to crash the service by repeatedly hitting the OAuth2 login endpoint. Each /oauth/login request permanently adds an entry to an in-memory registeredStates map that was never expired, deleted, or bounded, so sustained requests grow memory until the process is killed. No public exploit is identified at time of analysis, EPSS was not provided, and this is not in CISA KEV, but the flaw is trivially triggerable when OAuth2 authentication is enabled.
Technical ContextAI
OliveTin is a self-hosted Go application that exposes predefined shell commands through a web interface. The affected component is the OAuth2 login handler in service/internal/auth/otoauth2/restapi_auth_oauth2.go, which implements the standard OAuth2 authorization-code flow using an anti-CSRF 'state' parameter. For each login attempt the handler generates a state value and records an oauth2State object in the registeredStates map keyed by that state. The root cause is CWE-400 (Uncontrolled Resource Consumption): entries were inserted on every request but never garbage-collected, never bounded in count, and only removed on a successful callback that most attackers never complete. The CPE cpe:2.3:a:olivetin:olivetin:*:*:*:*:*:*:*:* confirms the affected product line. The vendor fix adds a createdAt timestamp per entry, a 900-second max-age sweep (matching the olivetin-sid-oauth cookie lifetime), a 10,000-entry hard cap that returns HTTP 503 when full, and explicit deletion of state entries during callback handling.
RemediationAI
Vendor-released patch: 3000.17.0 - upgrade OliveTin to 3000.17.0 or later, which bounds the registeredStates map to 10,000 entries, sweeps entries older than 900 seconds, and deletes state on callback (see https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xpxj-f2fm-rqch and commit ec114e95d297b806c3ca0c37bc139b3c9c517b3f). If immediate upgrade is not possible, place the OliveTin web interface behind a reverse proxy or WAF and rate-limit or restrict access to the /oauth/login endpoint, accepting the trade-off that aggressive rate limits may slow legitimate logins; alternatively, if OAuth2 is not required, switch to another supported authentication method to remove the vulnerable code path entirely, at the cost of reconfiguring how users authenticate. Restricting network exposure of the OliveTin instance to trusted networks also reduces the unauthenticated attack surface.
OS command injection in OliveTin web shell interface through version 3000.10.0. OliveTin provides web-based access to pr
OliveTin gives access to predefined shell commands from a web interface. [CVSS 8.8 HIGH]
Arbitrary file write in OliveTin prior to 3000.11.2 allows authenticated attackers to write files to arbitrary filesyste
OliveTin versions prior to 3000.10.2 are vulnerable to unauthenticated denial of service through the PasswordHash API en
OliveTin versions prior to 3000.10.3 are vulnerable to unauthenticated denial-of-service attacks when OAuth2 authenticat
OliveTin versions prior to 3000.11.0 suffer from broken access control allowing unauthenticated users to invoke the Kill
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/a
OS command injection in OliveTin versions 3000.2.0 through 3000.16.x allows an authenticated user to execute arbitrary s
OliveTin prior to version 3000.11.1 fails to enforce view permission checks on dashboard and API endpoints, allowing aut
OliveTin prior to version 3000.11.1 fails to invalidate server-side sessions upon user logout, allowing attackers with a
OliveTin versions prior to 3000.11.1 contain an authentication bypass in RestartAction that allows authenticated users t
Concurrent action execution in OliveTin versions 3000.0.0 and prior triggers a race condition in a shared text/template.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today