Unauthenticated attackers can cause a denial of service in OliveTin by exhausting container memory via the PasswordHash API endpoint.

The application fails to implement request throttling or resource limits on the PasswordHash API endpoint, allowing unauthenticated users to trigger computationally intensive hashing operations. By sending concurrent requests, an attacker can exhaust container memory and force a service crash.

Successful exploitation of this vulnerability results in a denial of service, which renders the OliveTin interface unavailable for legitimate administrative tasks. With a CVSS score of 7.5, this high severity flaw poses a significant risk to operational continuity, especially for environments relying on OliveTin for critical automation workflows.

Immediate Action: Update OliveTin to version 3000.10.2 or the specified patched commit to implement necessary resource limits.

Proactive Monitoring: Monitor container memory usage and review application access logs for a high volume of requests directed at the PasswordHash endpoint originating from unknown IP addresses.

Compensating Controls: Deploy a Web Application Firewall or rate-limiting proxy in front of the OliveTin interface to restrict the frequency of requests to the vulnerable API endpoint until the patch is applied.

Public Exploit Available: No (Exploit_available: false)

Given the potential for service disruption and the ease with which this vulnerability can be triggered, administrators should prioritize the deployment of the security update. Upgrading to version 3000.10.2 effectively addresses the lack of resource throttling and is the only definitive way to mitigate this denial of service risk.