PT-2026-22700 · Olivetin · Olivetin
Fg0X0
·
Published
2026-03-02
·
Updated
2026-03-25
·
CVE-2026-28342
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
OliveTin versions prior to 3000.10.2
Description
The
PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. Issuing multiple parallel requests can exhaust available container memory, leading to service degradation or a denial of service (DoS). The issue occurs because the endpoint performs computationally and memory-intensive hashing operations without request throttling, authentication requirements, or resource limits. The vulnerable endpoint is POST /api/olivetin.api.v1.OliveTinApiService/PasswordHash, which accepts a JSON body containing a password field. Each request triggers a memory-intensive hashing operation. In a test environment, 50 concurrent requests resulted in approximately 3.2 GB of memory usage. This allows unauthenticated attackers to perform a denial of service attack by exhausting server memory resources.Recommendations
Versions prior to 3000.10.2 should be updated to version 3000.10.2 or later.
Exploit
Fix
DoS
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Olivetin