CVE-2026-67437

Deferred Deferred - Pending Action

Memory Exhaustion in OliveTin OAuth2 Login Handler

Publication date: 2026-07-29

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or bounding entries, allowing an unauthenticated attacker to exhaust memory and cause a denial of service. This issue is fixed in version 3000.17.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-30

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-67437

EUVD

EUVD-2026-50563

Affected Vendors & Products

Vendor	Product	Version / Range
olivetin	olivetin	3000.17.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in OliveTin versions 3000.0.0 to 3000.17.0 involves the OAuth2 login handler storing login state in memory without expiration or cleanup. An unauthenticated attacker can repeatedly trigger login requests to fill memory, causing a denial of service.

Detection Guidance

Detecting this vulnerability requires checking the OliveTin version in use. If your system runs a version between 3000.0.0 and 3000.17.0, it is vulnerable. Check the version by running: olivetin --version or inspecting the installed package version.

Impact Analysis

The vulnerability can cause system crashes or slowdowns due to memory exhaustion. If OliveTin is used in production, it may lead to service unavailability, disrupting operations dependent on the web interface.

Compliance Impact

This vulnerability causes a denial of service due to memory exhaustion, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the availability of systems storing protected health information.

Mitigation Strategies

Upgrade OliveTin to version 3000.17.0 or later immediately. This fixes the memory exhaustion issue by properly managing OAuth2 login state. If upgrading is not possible, restrict access to the web interface or disable OAuth2 login temporarily.

Hi! I’m here to help you understand CVE-2026-67437. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70