Skip to content
Fencer Vulns
high 7.5

CVE-2026-67437 json

OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

published 2026-07-29 3 mo ago modified 2026-08-18 2 mo ago also GHSA-xpxj-f2fm-rqch , GO-2026-6146 , EUVD-2026-50563

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or bounding entries, allowing an unauthenticated attacker to exhaust memory and cause a denial of service. This issue is fixed in version 3000.17.0.

Patch / fix

  • go github.com/OliveTin/OliveTin 0.0.0-20260708075951-ec114e95d297
  • govulncheck-vulndb SLES for SAP applications 16.0, SLES 16.0 0.0.20260827T195228-160000.1.1

suse advisories SUSE-SU-2026:23625-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260827T195228-160000.1.1

opensuse advisories openSUSE-SU-2026:21761-1

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.64% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xpxj-f2fm-rqch referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/OliveTin/OliveTin
>=0.0.0-20251024001301-45f9c18bc3ee, <0.0.0-20260708075951-ec114e95d297
0.0.0-20260708075951-ec114e95d297

Affected products

  • OliveTin OliveTin

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-401 Missing Release of Memory after Effective Lifetime
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.