CVE-2026-28342

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28342", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-26T18:38:13.889Z", "datePublished": "2026-03-05T19:33:44.300Z", "dateUpdated": "2026-03-06T18:02:40.848Z"}, "containers": {"cna": {"title": "OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp"}, {"name": "https://github.com/OliveTin/OliveTin/commit/2eb5f0ba79d4bbef3c802bf8b4666a7e18dcfd90", "tags": ["x_refsource_MISC"], "url": "https://github.com/OliveTin/OliveTin/commit/2eb5f0ba79d4bbef3c802bf8b4666a7e18dcfd90"}, {"name": "https://github.com/OliveTin/OliveTin/releases/tag/3000.10.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.10.2"}], "affected": [{"vendor": "OliveTin", "product": "OliveTin", "versions": [{"version": "< 3000.10.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-05T19:33:44.300Z"}, "descriptions": [{"lang": "en", "value": "OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available container memory, leading to service degradation or complete denial of service (DoS). The issue occurs because the endpoint performs computationally and memory-intensive hashing operations without request throttling, authentication requirements, or resource limits. This issue has been patched in version 3000.10.2."}], "source": {"advisory": "GHSA-pc8g-78pf-4xrp", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T18:02:37.019994Z", "id": "CVE-2026-28342", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:02:40.848Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28342", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-06T18:02:37.019994Z"}}}], "references": [{"url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:02:28.622Z"}}], "cna": {"title": "OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint", "source": {"advisory": "GHSA-pc8g-78pf-4xrp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "OliveTin", "product": "OliveTin", "versions": [{"status": "affected", "version": "< 3000.10.2"}]}], "references": [{"url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp", "name": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/OliveTin/OliveTin/commit/2eb5f0ba79d4bbef3c802bf8b4666a7e18dcfd90", "name": "https://github.com/OliveTin/OliveTin/commit/2eb5f0ba79d4bbef3c802bf8b4666a7e18dcfd90", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.10.2", "name": "https://github.com/OliveTin/OliveTin/releases/tag/3000.10.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available container memory, leading to service degradation or complete denial of service (DoS). The issue occurs because the endpoint performs computationally and memory-intensive hashing operations without request throttling, authentication requirements, or resource limits. This issue has been patched in version 3000.10.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-05T19:33:44.300Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28342", "state": "PUBLISHED", "dateUpdated": "2026-03-06T18:02:40.848Z", "dateReserved": "2026-02-26T18:38:13.889Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-05T19:33:44.300Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "OliveTin", "vendor": "OliveTin", "versions": [{"status": "affected", "version": "< 3000.10.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:olivetin:olivetin:*:*:*:*:*:*:*:*", "matchCriteriaId": "899D9A60-A4C1-48DE-968A-1E146C461C75", "versionEndExcluding": "3000.10.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available container memory, leading to service degradation or complete denial of service (DoS). The issue occurs because the endpoint performs computationally and memory-intensive hashing operations without request throttling, authentication requirements, or resource limits. This issue has been patched in version 3000.10.2."}, {"lang": "es", "value": "OliveTin da acceso a comandos shell predefinidos desde una interfaz web. Antes de la versi\u00f3n 3000.10.2, el endpoint de la API PasswordHash permite a usuarios no autenticados activar una asignaci\u00f3n excesiva de memoria enviando solicitudes concurrentes de hash de contrase\u00f1as. Al emitir m\u00faltiples solicitudes paralelas, un atacante puede agotar la memoria disponible del contenedor, lo que lleva a la degradaci\u00f3n del servicio o a una denegaci\u00f3n de servicio (DoS) completa. El problema ocurre porque el endpoint realiza operaciones de hashing computacionalmente y de memoria intensivas sin limitaci\u00f3n de solicitudes, requisitos de autenticaci\u00f3n o l\u00edmites de recursos. Este problema ha sido parcheado en la versi\u00f3n 3000.10.2."}], "id": "CVE-2026-28342", "lastModified": "2026-06-17T10:28:27.423", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28342", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T18:02:37.019994Z", "version": "2.0.3"}}]}, "published": "2026-03-05T20:16:15.837", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/OliveTin/OliveTin/commit/2eb5f0ba79d4bbef3c802bf8b4666a7e18dcfd90"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.10.2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3000.10.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OliveTin", "source": "cna", "vendor": "OliveTin"}, "product": "olivetin", "vendor": "olivetin"}], "analysis": {"en": {"generated_at": "2026-04-16T12:13:12.808948+00:00", "value": {"mitigation_remediation": ["Upgrade OliveTin to version 3000.10.2 or later to remove the problematic code path.", "If an upgrade is not immediately possible, restrict network access to the PasswordHash endpoint using firewall rules or network segmentation to limit exposure.", "Implement application\u2011level throttling or request\u2011rate limits on the PasswordHash API to prevent excessive concurrent calls from exhausting memory."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "OliveTin products prior to version 3000.10.2 are affected. The vulnerability exists in all builds that expose the PasswordHash endpoint without authentication controls. Users running OliveTin containers on any platform are at risk until they apply the 3000.10.2 update or later. The vendor\u2019s advisory notes that the issue was fixed in the 3000.10.2 release, so only installations older than that are vulnerable.", "description_and_impact": "OliveTin\u2019s PasswordHash API endpoint permits unauthenticated users to trigger excessive memory allocation by submitting a large number of parallel requests. The endpoint performs computationally heavy hash operations without any form of authentication enforcement, throttling, or resource limits, allowing an attacker to deplete available container memory and degrade or halt the web service. This results in a loss of availability and can disrupt any applications relying on OliveTin. The weakness aligns with CWE\u2011400 (Uncontrolled Resource Consumption) and CWE\u2011770 (Memory Leak).", "risk_and_exploitability": "The reported CVSS score of 7.5 indicates a moderate\u2011to\u2011high risk, while the EPSS score of less than 1% shows a low probability of exploitation for average attackers. Because the attack requires only remote HTTP requests and no credentials, it is considered a remote, unauthenticated attack. The vulnerability is not listed in CISA\u2019s KEV catalog, suggesting no confirmed active exploits at the time of analysis. Nonetheless, the attack path\u2014sending a burst of legitimate API requests\u2014can be automated and executed from any accessible network endpoint, making mitigation through patching and rate\u2011limiting essential."}}}}, "created": "2026-03-06T15:01:15.739161+00:00", "updated": "2026-04-16T12:15:35.095091+00:00", "vendors": ["olivetin", "olivetin$PRODUCT$olivetin"]}