CVE-2026-28342 Details
Description
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available container memory, leading to service degradation or complete denial of service (DoS). The issue occurs because the endpoint performs computationally and memory-intensive hashing operations without request throttling, authentication requirements, or resource limits. This issue has been patched in version 3000.10.2.
A denial-of-service vulnerability has been identified in OliveTin versions prior to 3000.10.2. The issue arises in the PasswordHash API endpoint, which allows unauthenticated users to send concurrent password hashing requests. This leads to excessive memory allocation, exhausting available container memory and causing service degradation or a complete denial-of-service. The vulnerability exists because the endpoint performs resource-intensive hashing operations without authentication, request throttling, or resource limits.
Users can update to OliveTin version 3000.10.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp | CISA-ADP | ExploitVendor Advisory |
| https://github.com/OliveTin/OliveTin/commit/2eb5f0ba79d4bbef3c802bf8b4666a7e18dcfd90 | [email protected] | Patch |
| https://github.com/OliveTin/OliveTin/releases/tag/3000.10.2 | [email protected] | ProductRelease Notes |
| https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| olivetin olivetin | < 3000.10.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | CVE Modified | CISA-ADP |
| Mar 5, 2026 | New CVE Received | [email protected] |