DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-67437: CVE-2026-67437: Unauthenticated Denial of Service via OAuth2 State Memory Exhaustion in OliveTin

#security #cve #cybersecurity

CVE-2026-67437: Unauthenticated Denial of Service via OAuth2 State Memory Exhaustion in OliveTin

Vulnerability ID: CVE-2026-67437
CVSS Score: 7.5
Published: 2026-07-30

An uncontrolled resource consumption vulnerability (CWE-400) in OliveTin allows unauthenticated remote attackers to exhaust server memory and trigger a denial of service (DoS). By repeatedly initiating the OAuth2 login flow without completing it, attackers can force the server to allocate state variables in an unbounded in-memory map. This heap-based resource exhaustion eventually causes the host operating system to terminate the OliveTin process via the Out-Of-Memory (OOM) killer.

TL;DR

Unauthenticated remote attackers can exhaust OliveTin server memory and crash the application by flooding the OAuth2 login endpoint, forcing unbounded allocation of state variables in memory.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-400
  • Attack Vector: Network
  • CVSS v3.1: 7.5
  • EPSS Score: 0.00354
  • Impact: Denial of Service (DoS)
  • Exploit Status: PoC (Proof-of-Concept)
  • KEV Status: Not listed

Affected Systems

  • OliveTin
  • OliveTin: >= 3000.0.0, < 3000.17.0 (Fixed in: 3000.17.0)

Code Analysis

Commit: ec114e9

Bound OAuth2 states dynamic map allocation and passive sweeping

Mitigation Strategies

  • Upgrade to OliveTin 3000.17.0 or later
  • Implement rate-limiting on the /oauth/login route via a reverse proxy (e.g., Nginx)
  • Restrict access to the OliveTin interface using firewall rules or VPNs

Remediation Steps:

  1. Identify running versions of OliveTin using asset management or container manifests.
  2. Deploy the 3000.17.0 update across affected environments.
  3. Configure reverse proxies to limit HTTP requests to /oauth/login to prevent resource exhaustion or service unavailability.

References

Read the full report for CVE-2026-67437 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)