{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/olivetin/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-67437"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OliveTin"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OliveTin"],"content_html":"\u003cp\u003eOliveTin contains a vulnerability (CVE-2026-67437) where the application's OAuth2 login handler stores per-login state in an in-memory map (\u003ccode\u003eregisteredStates\u003c/code\u003e) that grows without bounds. Because the application fails to implement time-to-live (TTL) expiry, size limits, or cleanup mechanisms for these map entries, an unauthenticated attacker can trigger a denial-of-service (DoS) condition. By sending a high volume of requests to the \u003ccode\u003e/oauth/login\u003c/code\u003e endpoint, an attacker forces the application to allocate memory for each new state entry, eventually leading to OOM (Out of Memory) kills or severe service degradation. This vulnerability is distinct from previous concurrent map access issues, as it persists even when synchronization primitives are correctly implemented. Defenders should note that memory is not reclaimed after the attack stops, requiring a service restart to restore normal operation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to confirm the target OliveTin instance has OAuth2 providers configured.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the publicly accessible \u003ccode\u003e/oauth/login\u003c/code\u003e endpoint on the target instance.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a flood of HTTP GET requests to \u003ccode\u003e/oauth/login\u003c/code\u003e with the \u003ccode\u003eprovider\u003c/code\u003e parameter set.\u003c/li\u003e\n\u003cli\u003eThe OliveTin \u003ccode\u003eHandleOAuthLogin\u003c/code\u003e function executes, generating a new \u003ccode\u003eoauth2State\u003c/code\u003e entry.\u003c/li\u003e\n\u003cli\u003eThe application adds the new \u003ccode\u003eoauth2State\u003c/code\u003e to the \u003ccode\u003eregisteredStates\u003c/code\u003e in-memory map.\u003c/li\u003e\n\u003cli\u003eThe application performs a 302 redirect back to the attacker, but the state object remains permanently in memory.\u003c/li\u003e\n\u003cli\u003eThe process continues until system memory is exhausted, resulting in service crash or unresponsive application state.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a persistent denial-of-service for all users of the OliveTin instance. Because the leaked memory is not recovered until a process restart, even intermittent attacks can lead to cumulative degradation. The vulnerability affects all deployments configured with one or more OAuth2 providers and provides an unauthenticated vector for service disruption.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to the patched version of OliveTin (minimum version \u003ccode\u003e0.0.0-20260708075951-ec114e95d297\u003c/code\u003e) immediately to incorporate state cleanup mechanisms.\u003c/li\u003e\n\u003cli\u003eImplement rate limiting on the \u003ccode\u003e/oauth/login\u003c/code\u003e endpoint at the web application firewall or reverse proxy layer to mitigate high-frequency request floods.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule below to monitor for anomalous request volumes to the OAuth2 login endpoint.\u003c/li\u003e\n\u003cli\u003eMonitor application memory usage metrics (e.g., via Docker stats or container orchestration monitoring) for signs of anomalous, monotonic growth associated with \u003ccode\u003eolivetin-instance\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-07-30T15:30:25Z","date_published":"2026-07-30T15:30:25Z","id":"https://feed.craftedsignal.io/briefs/2026-07-olivetin-dos/","summary":"An unauthenticated attacker can trigger a denial-of-service in OliveTin by flooding the OAuth2 login endpoint, causing unbounded memory growth due to the lack of expiration for stored login states.","title":"OliveTin Unauthenticated OAuth2 Memory Exhaustion","url":"https://feed.craftedsignal.io/briefs/2026-07-olivetin-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - OliveTin","version":"https://jsonfeed.org/version/1.1"}