OliveTin’s PasswordHash API endpoint permits unauthenticated users to trigger excessive memory allocation by submitting a large number of parallel requests. The endpoint performs computationally heavy hash operations without any form of authentication enforcement, throttling, or resource limits, allowing an attacker to deplete available container memory and degrade or halt the web service. This results in a loss of availability and can disrupt any applications relying on OliveTin. The weakness aligns with CWE‑400 (Uncontrolled Resource Consumption) and CWE‑770 (Memory Leak).

OliveTin products prior to version 3000.10.2 are affected. The vulnerability exists in all builds that expose the PasswordHash endpoint without authentication controls. Users running OliveTin containers on any platform are at risk until they apply the 3000.10.2 update or later. The vendor’s advisory notes that the issue was fixed in the 3000.10.2 release, so only installations older than that are vulnerable.

The reported CVSS score of 7.5 indicates a moderate‑to‑high risk, while the EPSS score of less than 1% shows a low probability of exploitation for average attackers. Because the attack requires only remote HTTP requests and no credentials, it is considered a remote, unauthenticated attack. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed active exploits at the time of analysis. Nonetheless, the attack path—sending a burst of legitimate API requests—can be automated and executed from any accessible network endpoint, making mitigation through patching and rate‑limiting essential.