CVE-2026-28342: 
NixOS vulnerability analysis and mitigation

CVE-2026-28342 is an unauthenticated Denial of Service (DoS) vulnerability in OliveTin — a web interface for predefined shell commands — caused by memory exhaustion in the PasswordHash API endpoint. All versions prior to 3000.10.2 (Go module versions before 0.0.0-20260227002407-2eb5f0ba79d4) are affected. The vulnerability was reported by researcher fg0x0, published on March 1, 2026, and patched in version 3000.10.2 released February 27, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, OliveTin Advisory).

The root cause is uncontrolled resource consumption (CWE-400) and allocation of resources without limits or throttling (CWE-770) in the PasswordHash API endpoint (POST /api/olivetin.api.v1.OliveTinApiService/PasswordHash). The endpoint accepts a JSON body with a password field and performs a computationally and memory-intensive hashing operation per request, with no authentication requirement, rate limiting, request throttling, concurrency controls, or per-request memory caps. An attacker can send many parallel HTTP POST requests to this endpoint without any credentials, causing cumulative memory exhaustion; in testing, 50 concurrent requests consumed approximately 3.2 GB of RAM (~64 MB per request), driving CPU usage to 344% and causing service instability. The fix implemented a 10-slot semaphore around the password hash function to limit concurrency (OliveTin Advisory, OliveTin Release).

Successful exploitation results in complete loss of availability for the OliveTin service, with no impact on confidentiality or integrity. An unauthenticated remote attacker can exhaust container memory, crash the service, and trigger container termination in orchestrated environments (e.g., Kubernetes, Docker Swarm). Production deployments not protected by a reverse proxy with rate limiting (such as Nginx or Traefik) are especially at risk, as the attack requires no privileges or user interaction (OliveTin Advisory, GitHub Advisory).

A public proof-of-concept (PoC) exploit script is available in the GitHub Security Advisory, demonstrating exploitation via a simple shell loop using curl. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.30–0.61%, indicating a low but non-negligible probability of exploitation in the near term. No specific threat actor attribution has been reported (OliveTin Advisory, GitHub Advisory).

1. Reconnaissance: Identify internet-facing OliveTin instances (default port 1337) using tools like Shodan or Censys, or by directly probing known deployment URLs. Confirm the version is prior to 3000.10.2.
2. Identify the vulnerable endpoint: Target the unauthenticated API endpoint POST /api/olivetin.api.v1.OliveTinApiService/PasswordHash on the OliveTin host.
3. Craft concurrent requests: Prepare a script that sends many parallel HTTP POST requests with a JSON body containing a password field, e.g.:

for i in $(seq 1 50); do
  curl -s -X POST http://<target>:1337/api/olivetin.api.v1.OliveTinApiService/PasswordHash \
    -H "Content-Type: application/json" \
    -d "{\"password\":\"flood-$i\"}" &
done
wait

4. Trigger memory exhaustion: The concurrent requests each trigger a memory-intensive hashing operation. With 50 parallel requests, memory consumption reaches approximately 3.2 GB, causing service instability or container termination.
5. Confirm DoS: Monitor the target for service unavailability (HTTP errors, connection timeouts, or container restart events), confirming successful denial of service (OliveTin Advisory).

• Network: High volume of concurrent HTTP POST requests to /api/olivetin.api.v1.OliveTinApiService/PasswordHash from one or more source IPs; unusual spike in inbound traffic to port 1337.
• Logs: OliveTin access logs showing rapid, repeated POST requests to the PasswordHash endpoint with varying password values (e.g., flood-1, flood-2, etc.) in a short time window.
• Process/Container: Sudden spike in container memory usage (e.g., exceeding 3 GB) and CPU utilization (e.g., >300%) for the OliveTin container; container OOM (Out of Memory) kill events or unexpected restarts in orchestration platform logs (Docker, Kubernetes).
• System: OS-level OOM killer events in /var/log/syslog or dmesg referencing the OliveTin process (OliveTin Advisory).

Upgrade OliveTin to version 3000.10.2 or later, which introduces a 10-slot semaphore around the password hash function to prevent resource exhaustion. For deployments unable to patch immediately, implement network-level rate limiting on the PasswordHash API endpoint using a reverse proxy such as Nginx or Traefik, and restrict access to the OliveTin API port (default 1337) to trusted networks only. Enabling authentication on the OliveTin instance where possible will also reduce exposure (OliveTin Release, OliveTin Advisory).

The vulnerability was responsibly disclosed by researcher fg0x0 and acknowledged by OliveTin maintainer jamesread, who credited the reporter in the release notes. The fix was released promptly alongside other security improvements in version 3000.10.2. No significant broader media coverage or notable community debate has been identified beyond the GitHub advisory and standard CVE aggregator coverage (OliveTin Release, OliveTin Advisory).