{"cve":"CVE-2026-28342","nvd":{"published":"2026-03-05T20:16:15.837","modified":"2026-06-17T10:28:27.423","status":"Analyzed","description":"OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available container memory, leading to service degradation or complete denial of service (DoS). The issue occurs because the endpoint performs computationally and memory-intensive hashing operations without request throttling, authentication requirements, or resource limits. This issue has been patched in version 3000.10.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400","CWE-770"],"references":["https://github.com/OliveTin/OliveTin/commit/2eb5f0ba79d4bbef3c802bf8b4666a7e18dcfd90","https://github.com/OliveTin/OliveTin/releases/tag/3000.10.2","https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp","https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp"],"products":["olivetin:olivetin"],"source":"nvd","synced_at":"2026-10-19T22:25:53.701907451+00:00"},"epss":{"cve":"CVE-2026-28342","score":0.0075,"percentile":0.54956,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-pc8g-78pf-4xrp","url":"https://osv.dev/vulnerability/GHSA-pc8g-78pf-4xrp","summary":"OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint","modified":"2026-03-23T04:55:58.994286526Z","packages":[{"ecosystem":"Go","name":"github.com/OliveTin/OliveTin","purl":"pkg:golang/github.com/OliveTin/OliveTin","ranges":["<0.0.0-20260227002407-2eb5f0ba79d4"],"fixed":["0.0.0-20260227002407-2eb5f0ba79d4"]}]},{"id":"GO-2026-4584","url":"https://osv.dev/vulnerability/GO-2026-4584","summary":"OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint in github.com/OliveTin/OliveTin","modified":"2026-03-23T04:53:11.839250Z","packages":[{"ecosystem":"Go","name":"github.com/OliveTin/OliveTin","purl":"pkg:golang/github.com/OliveTin/OliveTin","ranges":["<0.0.0-20260227002407-2eb5f0ba79d4"],"fixed":["0.0.0-20260227002407-2eb5f0ba79d4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}