Executive brief
OliveTin, a tool for providing a simple web interface for running shell commands, is vulnerable to a denial-of-service attack. An unauthenticated attacker can flood the login system with requests that consume server memory without ever releasing it. This can lead to the server crashing or becoming completely unresponsive, requiring a manual restart to restore service.
Technical details
The vulnerability is a resource exhaustion issue (unbounded map growth) located in the OAuth2 login handler (`registeredStates` map in `restapi_auth_oauth2.go`). Every request to the `/oauth/login` endpoint generates a new state entry in an in-memory map that lacks a Time-To-Live (TTL), maximum size limit, or cleanup mechanism. An unauthenticated remote attacker can send a high volume of requests to this endpoint to fill the map, eventually causing the Go runtime to exhaust available system memory and trigger an Out-Of-Memory (OOM) kill. This issue persists even in versions that patched concurrent map access (CVE-2026-28789) because the fundamental lack of entry deletion remains. A patch is available in version 0.0.0-20260708075951-ec114e95d297.
Affected products
- OliveTin OliveTin >= 0.0.0-20251024001301-45f9c18bc3ee, < 0.0.0-20260708075951-ec114e95d297
Timeline
- 2026-07-08: patched: Fixed in version 0.0.0-20260708075951-ec114e95d297
- 2026-07-30: advisory: GHSA-xpxj-f2fm-rqch published