THREAT OPS › Threat News › [GHSA] GHSA-xpxj-f2fm-rqch (high) — OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)
[GHSA] GHSA-xpxj-f2fm-rqch (high) — OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)
GHSA-xpxj-f2fm-rqch Severity: high CVE: CVE-2026-67437
OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)
## Summary
OliveTin's OAuth2 login handler stores per-login state in an in-memory map (`registeredStates`) that grows unboundedly. States are added on every `/oauth/login` request but are **never deleted or expired**. An unauthenticated attacker can send
Indicators of compromise
- CVE-2026-67437cve
- CVE-2026-28789cve
- http://127.0.0.1:1337/oauth/callbackurl
- http://127.0.0.1:1337/readyzurl
- http://127.0.0.1:1337/oauth/login?provider=githuburl
- http://127.0.0.1:1337url
Original source: https://github.com/advisories/GHSA-xpxj-f2fm-rqch