Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available container memory, leading to service degradation or complete denial of service (DoS). The issue occurs because the endpoint performs computationally and memory-intensive hashing operations without request throttling, authentication requirements, or resource limits. This issue has been patched in version 3000.10.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28342 Unauthenticated Denial of Service via Memory Exhaustion in OliveTin Web Interface https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28342
Post summary
The text announces CVE‑2026‑28342, detailing an unauthenticated DoS vector via memory exhaustion in OliveTin’s web interface, with no evidence of exploitation or mitigation mentioned.
CVE-2026-28342 OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to tri… https://www.cve.org/CVERecord?id=CVE-2026-28342
Post summary
The text describes a CVE-2026-28342 flaw in OliveTin that permits unauthenticated execution of predefined shell commands through the PasswordHash API, which is rectified in version 3000.10.2.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | olivetin | olivetin | - | - | - |